6.3.1Security vulnerabilities are identified and addressed

Defined Approach Requirements:

Security vulnerabilities are identified and managed as follows:

- New security vulnerabilities are identified using industry-recognized sources for security vulnerability information, including alerts from international and national computer emergency response teams (CERTs).

- Vulnerabilities are assigned a risk ranking based on industry best practices and consideration of potential impact.

- Risk rankings identify, at a minimum, all vulnerabilities considered to be a high-risk or critical to the environment.

- Vulnerabilities for bespoke and custom, and third-party software (for example operating systems and databases) are covered.

Defined Approach Testing Procedures:

6.3.1.a Examine policies and procedures for identifying and managing security vulnerabilities to verify that processes are defined in accordance with all elements specified in this requirement.

6.3.1.b Interview responsible personnel, examine documentation, and observe processes to verify that security vulnerabilities are identified and managed in accordance with all elements specified in this requirement.