Vulnerability Management and Patching
1. Vulnerability Management Process
The organisation applies a continuous process of identifying, assessing, prioritising and remediating vulnerabilities in IT/OT systems. CVSS (Common Vulnerability Scoring System) criteria form the basis for prioritising remediation actions.
2. Vulnerability Scanning
| Scanning scope | Frequency | Tool | Responsible |
|---|---|---|---|
| All IT systems (internal network) | ▸ [weekly]min. 1×/month | ▸ [e.g. Tenable Nessus / Qualys / OpenVAS / Rapid7] | ▸ IT Admin / CISO |
| Web services and applications | ▸ [weekly]min. 1×/month | ▸ [e.g. OWASP ZAP / Burp Suite / Acunetix] | ▸ IT Admin / CISO |
| OT/ICS systems | ▸ [quarterly + after every change]min. 2×/year | ▸ [passive OT tool, e.g. Claroty / Dragos] | ▸ OT Admin / CISO |
| Internet-facing assets (external) | ▸ [weekly]min. 1×/month | ▸ [external scanning / ASM] | ▸ CISO |
3. Classification and Patching SLA
| CVSS Level | CVSS Score | Name | Patching SLA | Deadline for OT systems |
|---|---|---|---|---|
| Critical | 9.0 – 10.0 | Critical | ▸ 72 hoursmax. 72h – NIS2 | ▸ [e.g. 7 days with isolation]immediately with compensating control |
| High | 7.0 – 8.9 | High | ▸ [30 days]max. 30 days | ▸ [e.g. 60 days with compensating control] |
| Medium | 4.0 – 6.9 | Medium | ▸ [90 days]max. 90 days | ▸ [e.g. 180 days] |
| Low | 0.1 – 3.9 | Low | ▸ [180 days]max. 180 days or accept | ▸ [at next maintenance window] |
| None | 0.0 | None/Info | No SLA – CISO decision | — |
Zero-Day Vulnerabilities
For actively exploited zero-day vulnerabilities (confirmed in-the-wild exploit) – patch or compensating control within ▸ [24 hours]max. 72h per NIS2 regardless of CVSS score. Tracking: CISA KEV (Known Exploited Vulnerabilities), NVD, national CERT advisories, vendor bulletins.
4. Compensating Controls
If a patch cannot be deployed within SLA (e.g. no maintenance window, no vendor patch available), a temporary compensating control must be implemented:
- Isolation of vulnerable system (VLAN, firewall rule),
- Disable the vulnerable feature/service,
- Enhanced monitoring of the system,
- Restrict access to minimum.
Any SLA deviation must be approved by the CISO and documented in the Risk Register (DOC-003).
5. Penetration Tests
| Test type | Scope | Frequency | Executor | Executor requirements |
|---|---|---|---|---|
| External penetration test | Internet-facing services | ▸ [annually]min. 1×/year – NIS2 | ▸ [external company – independence required] | ▸ [e.g. OSCP certified, relevant sector experience] |
| Internal penetration test | Internal network, AD, applications | ▸ [annually]min. 1×/year | ▸ [external company or internal red team] | ▸ |
| Web application pentest | Public applications (OWASP Top 10) | ▸ [after each major release + 1×/year] | ▸ [external company] | ▸ |
Penetration test results are confidential (classification: SECRET) and provided only to the CISO and Board. Identified vulnerabilities remediated per SLA in section 3.
6. Vulnerability Intelligence Sources
- NVD (National Vulnerability Database): nvd.nist.gov
- CISA KEV (Known Exploited Vulnerabilities): cisa.gov/known-exploited-vulnerabilities-catalog
- National CERT advisories
- Vendor security bulletins (Microsoft Patch Tuesday, Adobe, Apple, etc.)
- ▸ [additional ISAC / sector-specific intelligence sources]
7. Change History
| Version | Date | Author | Description | Approved by |
|---|---|---|---|---|
| ▸ 1.0 | ▸ DD/MM/YYYY | ▸ | ▸ Initial release | ▸ Board |