TVM-04 Detection Updates
Update detection tooling, threat signatures and indicators of compromise at least weekly, and more often where the threat requires it.
4
artefacts
2
held by a system
1
at each review
easy
to go live
Cloud console / configuration management
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Configuration of automatic update where available · Cloud console / configuration management
- Monitoring that catches an update failure · SIEM / log platform
periodic reviewEvidence produced at each review
- Update records for detection tools and signatures showing frequency · Document repository
governing documentDocuments that govern the control
- Coverage across all detection tooling, not one product · Document repository
First move
Automate the pull from your Cloud console / configuration management. Configuration snapshots and change history from the cloud console or IaC repository, diffed against the baseline.
Common gaps auditors find
- Updates automatic on some tools and manual and lapsed on others
- Update failures unnoticed because nothing monitors currency
- Weekly cadence documented while actual updates are monthly
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetTVM-03 Vulnerability Remediation Schedule · TVM-05 External Library Vulnerabilities