Vulnerability Management
What is Vulnerability Management?
The ongoing practice of identifying, evaluating, treating, and reporting on security vulnerabilities in systems and software. Vulnerability management programmes include regular scanning, risk-based prioritisation, and timely remediation.
Terms that appear alongside vulnerability management
Each of these is named in at least one of the same controls as vulnerability management. The number is how many controls name both.
- encryption 21 shared controls
- nist 19 shared controls
- incident response 19 shared controls
- penetration testing 18 shared controls
- audit 18 shared controls
- cybersecurity 17 shared controls
- remediation 16 shared controls
- authentication 15 shared controls
Frameworks that govern vulnerability management
What the standards actually require on vulnerability management
Requirements naming vulnerability management across 6 standards, quoted from the control text.
The plan must require that the incident response plan includes processes for vulnerabilities newly found while responding, documents or mitigates them, and integrates with the vulnerability management plan.
api-1164::RS.MI-3 · RS.MI-3 Vulnerabilities found during response documented or mitigated through vulnerability management →Define, monitor and report vulnerability identification and remediation metrics at set intervals.
CCM-TVM-10 · Vulnerability Management Metrics →The organisation sets measures for finding and fixing vulnerabilities, tracks them, and reports them at set intervals.
cloud-security-alliance-cloud-controls-matrix-ccm-v4-1::TVM-12 · Vulnerability Management Metrics →For severe vulnerabilities, also manage remediation at other third parties including cloud providers, using assurance reports and contracts.
japan-fsa-cybersecurity-guidelines-for-financial-institutions::2.2.3-D · 2.2.3 Vulnerability management of hardware and software: desirable actions →Cybersecurity requirements for technical vulnerability management are identified, documented and approved.
saudi-nca-ecc::2-10-1 · 2-10-1 Vulnerability management requirements defined →Set up and keep a written process for managing vulnerabilities in enterprise assets. Revisit the documentation each year, or sooner when a major change in the enterprise could affect this Safeguard.
CIS-7.1 · Establish and Maintain a Vulnerability Management Process →Questions people ask about vulnerability management
What is Vulnerability Management?
Why is Vulnerability Management important for compliance?
Which compliance frameworks address Vulnerability Management?
Where can I learn more about Vulnerability Management?
See how Vulnerability Management applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.