6.4.1 For public-facing web applications, new threats and vulnerabilities are addressed on an ongoing basis and these applications are protected against known attacks as follows: • Reviewing public-facing web applications via manual or automated application
For public-facing web applications, new threats and vulnerabilities are addressed on an ongoing basis and these applications are protected against known attacks as follows: • Reviewing public-facing web applications via .
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- Where assessment is used, records of reviews at least once every 12 months and after each change, by an entity specialising in application security · Document repository
- Evidence that all vulnerabilities found were ranked, corrected and the application re-evaluated after correction · Vulnerability scanner / patch tooling
- Independence evidence for the assessing party · Document repository
governing documentDocuments that govern the control
- Documented process defining which of the permitted methods is used for public-facing web applications · Document repository
- Inventory of public-facing web applications, reconciled so none are outside the process · Policy repository / GRC workspace
First move
Common gaps auditors find
- Annual assessment performed while the after each change trigger is ignored, which is where most exposure appears
- Findings corrected without re-evaluation, so the fix is unverified
- Application inventory incomplete, missing marketing sites and APIs that reach the same environment
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet6.3.3 All system components are protected from known vulnerabilities by installing applicable security patches/updates as follows: • Patches/updates for critical vulnerabilities (identified according to the risk ranking process at Requirement 6.3.1) are installed within one · 6.4.2 For public-facing web applications, an automated technical solution is deployed that continually detects and prevents web-based attacks, with at least the following: • Is installed in front of public-facing web applications and is configured