RS.AN-05
Does your organization have a formal process to receive, analyze, and respond to security vulnerabilities disclosed from both internal and external sources?
Explanation
Vulnerability handling is the focus here, specifically whether a formal process lets you receive, analyze, and respond to flaws disclosed from both internal and external sources. An effective vulnerability management process ensures timely identification, prioritization, and remediation of security weaknesses before they can be exploited.
Evidence of compliance could include a documented vulnerability management policy, screenshots of vulnerability tracking systems, process flowcharts showing the handling procedures from receipt to resolution, or metrics showing vulnerability response times and remediation rates.
Context
- Function
- RS: RESPOND
- Category
- RS.AN: Incident Analysis
- Sub-Category
- Processes are established to receive, analyze and respond to vulnerabilities disclosed to the organization from internal and external sources (e.g. internal testing, security bulletins, or security researchers)
Related questions
- Does your organization have a documented process for investigating notifications from security detection systems?
- Does your organization have a formal process to assess and document the impact of security incidents?
- Does your organization have a documented process for reconstructing the chronological sequence of security incidents, including all affected assets and resources?
- Does your incident response process include identification and analysis of vulnerabilities, threats, and threat actors involved in security incidents?
- Does your organization conduct root cause analysis to identify systemic issues when investigating security incidents?
- Does your organization utilize cyber deception technologies to gather intelligence on attacker behavior and tactics?