OPS-18 Managing Vulnerabilities, Malfunctions and Errors - Concept
Publish technical and organisational rules for vulnerability handling requiring regular identification of vulnerabilities, assessment of their severity, prioritised remediation or mitigation within defined timelines, and
4
artefacts
0
held by a system
0
at each review
hard
to go live
Policy repository / GRC workspace
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
none for this control
governing documentDocuments that govern the control
- Vulnerability policy stating the severity scale and the deadline attached to each level · Policy repository / GRC workspace
- Documented handling route for components that cannot be remediated, including compensating controls · Policy repository / GRC workspace
- List of approved vulnerability information sources feeding the identification process · Policy repository / GRC workspace
- Risk acceptance register recording deviations from the remediation deadlines · Policy repository / GRC workspace
First move
This control is evidenced by people and documents, not systems. Put the document under version control with an owner and review date, and log each review as a record with reviewer and date. Do not try to automate it.
Common gaps auditors find
- Severity scale defined without any corresponding remediation deadline
- No documented path for end of life components that will never receive a fix
- Rules limited to operating systems and silent on libraries, images and firmware
- Risk acceptances granted verbally, never recorded and never time limited
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetOPS-17 Logging and Monitoring - Availability of the Monitoring Software · OPS-19 Managing Vulnerabilities, Malfunctions and Errors - Penetration Tests