D.1.1 Vulnerability analysis
Control Details
Objective
Plan the resolution of discovered vulnerabilities
Definition
Enter discovered vulnerabilities into a defect management system. Analyze each vulnerability to gather sufficient information to plan its remediation. Plan a risk response and prioritization, such as by estimating the probability of exploitation and the impact if it is exploited.
Assessment Questions
- How are discovered vulnerabilities recorded and triaged?
- How are the vulnerabilities prioritized for remediation?
- What mechanisms are used for prioritization, e.g. is a severity rating, such as CVSS, used to aid prioritization?
- Is the access control to vulnerability information more restrictive than plain bug tracker defects?