TVM: Threat & Vulnerability Management

Establish, document, approve, communicate, apply, evaluate and maintain policies and procedures to identify, report and prioritize the remediation of vulnerabilities, in order to protect systems against vulnerability exploitation. Review and update the policies and procedures at least annually.

Establish, document, approve, communicate, apply, evaluate and maintain policies and procedures to protect against malware on managed assets. Review and update the policies and procedures at least annually.

Define, implement and evaluate processes, procedures and technical measures to enable both scheduled and emergency responses to vulnerability identifications, based on the identified risk.

Define, implement and evaluate processes, procedures and technical measures to update detection tools, threat signatures, and indicators of compromise on a weekly, or more frequent basis.

Define, implement and evaluate processes, procedures and technical measures to identify updates for applications which use third party or open source libraries according to the organization's vulnerability management policy.

Define, implement and evaluate processes, procedures and technical measures for the periodic performance of penetration testing by independent third parties.

Define, implement and evaluate processes, procedures and technical measures for the detection of vulnerabilities on organizationally managed assets at least monthly.

Use a risk-based model for effective prioritization of vulnerability remediation using an industry recognized framework.

Define and implement a process for tracking and reporting vulnerability identification and remediation activities that includes stakeholder notification.

Establish, monitor and report metrics for vulnerability identification and remediation at defined intervals.