Vulnerability
What is Vulnerability?
A weakness in a system, application, or process that could be exploited by a threat actor to gain unauthorised access or cause harm. Vulnerabilities can exist in software, hardware, configurations, or procedures.
Terms that appear alongside vulnerability
Each of these is named in at least one of the same controls as vulnerability. The number is how many controls name both.
- remediation 59 shared controls
- cybersecurity 53 shared controls
- nist 50 shared controls
- vulnerability disclosure 44 shared controls
- policy 42 shared controls
- audit 42 shared controls
- penetration testing 41 shared controls
- vulnerability scanning 40 shared controls
Frameworks that govern vulnerability
What the standards actually require on vulnerability
Requirements naming vulnerability across 6 standards, quoted from the control text.
Establishing a point of contact such as a CSIRT or PSIRT for receiving and handling vulnerability reports
30111-5.2 · Vulnerability handling team →A vulnerability scanner with an up-to-date vulnerability database is used for vulnerability scanning activities.
ISM-1808 · A vulnerability scanner with an up-to-date vulnerability database is used for vulnerabilit →Expected contents and format of vulnerability reports including technical details
29147-6.2 · Vulnerability report contents →Define, monitor and report vulnerability identification and remediation metrics at set intervals.
CCM-TVM-10 · Vulnerability Management Metrics →Vulnerability Monitoring and Scanning | Breadth and Depth of Coverage. Define the breadth and depth of vulnerability scanning coverage
RA-5(3) · Vulnerability Monitoring and Scanning | Breadth and Depth of Coverage. Define the breadth and depth of vulnerability scanning coverage →Perform automated vulnerability scans of externally-exposed enterprise assets using a SCAP-compliant vulnerability scanning tool. Perform scans on a monthly, or more frequent, basis.
CIS-7.6 · Perform Automated Vulnerability Scans of Externally-Exposed Enterprise Assets →Questions people ask about vulnerability
What is Vulnerability?
Why is Vulnerability important for compliance?
Which compliance frameworks address Vulnerability?
Where can I learn more about Vulnerability?
See how Vulnerability applies across compliance frameworks
Our platform maps 686 frameworks with 311K cross-framework control mappings. Explore how this concept is addressed across standards.