Define, implement and evaluate processes, procedures and technical measures for the detection of vulnerabilities on organizationally managed assets at least monthly.
The integrated TVM system should track vulnerabilities to closure and report them to build oversight of residual risks. Furthermore, the system should retain information that can be reused in future remediation activities. Organizations should consider establishing an external-facing vulnerability disclosure program to allow external parties to communicate detected vulnerabilities.
- Examine policy for adequacy, currency, and effectiveness.
- Determine if vulnerability detection is undertaken as required, and at least monthly.
[csf.tools Note: For more information on the Cloud Controls Matrix, visit the CSA Cloud Controls Matrix Homepage.]
Cloud Control Matrix is Copyright 2023 Cloud Security Alliance.