Threat and Vulnerability Management
What is Threat and Vulnerability Management?
An ongoing programme for identifying, evaluating, and addressing threats and vulnerabilities in an organisation's IT environment. Combines threat intelligence, vulnerability scanning, risk prioritisation, and remediation tracking.
Frameworks that govern threat and vulnerability management
What the standards actually require on threat and vulnerability management
Requirements naming threat and vulnerability management across 3 standards, quoted from the control text.
Threats to and vulnerabilities in the software are identified, assessed and addressed through a maintained process.
pci-ssf::10.1 · Secure Software Standard 10.1 (Threat and Vulnerability Management) →Keep approved policies and procedures for identifying, reporting and prioritising vulnerability remediation so systems are not left open to exploitation, and review them at least annually.
CCM-TVM-01 · Threat and Vulnerability Management Policy and Procedures →The organisation maintains approved and enforced policies and procedures for finding, reporting and prioritising the fixing of vulnerabilities and threats so systems are protected against exploitation, communicates them, checks how well they work, and revisits...
cloud-security-alliance-cloud-controls-matrix-ccm-v4-1::TVM-01 · Threat and Vulnerability Management Policy and Procedures →Questions people ask about threat and vulnerability management
What is Threat and Vulnerability Management?
Why is Threat and Vulnerability Management important for compliance?
Which compliance frameworks address Threat and Vulnerability Management?
Where can I learn more about Threat and Vulnerability Management?
See how Threat and Vulnerability Management applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.