TVM-07 Vulnerability Identification
Scan organisationally managed assets for vulnerabilities at least monthly through a defined and evaluated process.
4
artefacts
2
held by a system
0
at each review
easy
to go live
Vulnerability scanner / patch tooling
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Scan schedules and completed scan records covering the last several months · Vulnerability scanner / patch tooling
- Authenticated scanning configuration where applicable · Vulnerability scanner / patch tooling
periodic reviewEvidence produced at each review
none for this control
governing documentDocuments that govern the control
- Asset coverage evidence comparing scanned assets to the asset inventory · Policy repository / GRC workspace
- Evaluation that the scanning finds what it should · Policy repository / GRC workspace
First move
Automate the pull from your Vulnerability scanner / patch tooling. Scan schedule, findings and remediation age straight from the scanner; patch compliance from the patch console.
Common gaps auditors find
- Coverage gaps between the asset inventory and what is actually scanned
- Unauthenticated scanning only, understating the findings
- Monthly cadence claimed with gaps in the scan history
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetTVM-06 Penetration Testing · TVM-08 Vulnerability Prioritization