Vulnerability
What is Vulnerability?
A weakness in a system, application, or process that could be exploited by a threat actor to gain unauthorised access or cause harm. Vulnerabilities can exist in software, hardware, configurations, or procedures.
Terms that appear alongside vulnerability
Each of these is named in at least one of the same controls as vulnerability. The number is how many controls name both.
- remediation 59 shared controls
- cybersecurity 53 shared controls
- nist 50 shared controls
- vulnerability disclosure 44 shared controls
- policy 42 shared controls
- audit 42 shared controls
- penetration testing 41 shared controls
- vulnerability scanning 40 shared controls
Frameworks that govern vulnerability
What the standards actually require on vulnerability
Requirements naming vulnerability across 6 standards, quoted from the control text.
The policy should state what a report should contain (Annex B lists the information to request): affected product and version, description, steps to reproduce, proof of concept, perceived impact, the reporter's contact details and preferences.
iso-iec-29147-2018::9.3.2 · 9.3.2 Vulnerability report contents →Manufacturers must put in place and enforce a policy on coordinated vulnerability disclosure.
eu-cyber-resilience-act::Annex I Part II(5) · Coordinated vulnerability disclosure policy →A PSIRT may test products or services the vendor itself offers, or arrange for them to be tested, for vulnerabilities and other security problems; vulnerabilities found this way should go through the vendor's vulnerability handling processes.
iso-iec-30111-2019::6.5.3.7 · 6.5.3.7 Internal vulnerability assessment →Processes watch for insider activity that could lead to theft or destruction of data.
ffiec-cybersecurity-assessment-tool-cat::D3.DC.Th.E.6 · D3.DC.Th.E.6 Threat and Vulnerability Detection (Evolving 6) →Vulnerability assessments define, identify and classify vulnerabilities in computers, networks and communications infrastructure with scanners and tools that search for known vulnerabilities and classes and for conformance with approved configurations, at a fr...
ffiec-it-examination-handbook::IS-IV.A.2(c) · IV.A.2(c) Vulnerability Assessments (Information Security) →Internal vulnerability scans must use authenticated scanning, with these conditions: systems that cannot accept scanning credentials are documented; systems that do accept credentials are scanned with sufficient privileges;
11.3.1.2 · 11.3.1.2 Authenticated internal vulnerability scanning →Questions people ask about vulnerability
What is Vulnerability?
Why is Vulnerability important for compliance?
Which compliance frameworks address Vulnerability?
Where can I learn more about Vulnerability?
See how Vulnerability applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.