ISMS/03-procedures/vulnerability-management-procedure.md

Title: Vulnerability Management Procedure Document ID: [PROC-VULN-001] Version: 0.1 Draft Status: Draft Owner: CISO (Paul Jenkins) Approver: CISO (Paul Jenkins) Classification: Internal Effective date: [DD Month YYYY] Review date: [DD Month YYYY]

Vulnerability Management Procedure

Purpose

This procedure defines how BlackDice should identify, assess, prioritise, track, and close vulnerabilities affecting in-scope assets and services.

Scope

This procedure applies to applications, infrastructure, cloud services, Kubernetes environments, endpoints, dependencies, and other in-scope technology assets.

Trigger / When Used

Use this procedure when:

• new vulnerabilities are identified
• periodic scanning or review takes place
• supplier notifications or intelligence indicate exposure
• incidents, audits, or testing reveal security weaknesses

Procedure Steps

1. Collect vulnerability findings from approved sources such as scanning, review, supplier notifications, or manual assessment.
2. Validate the finding and identify the affected asset, service, version, environment, and owner.
3. Assess severity using technical characteristics, business context, exposure, exploitability, and service criticality.
4. Determine the remediation approach, such as patching, configuration change, code fix, compensating control, or risk acceptance.
5. Record the finding, owner, target date, and status in the approved tracking mechanism.
6. Prioritise remediation for externally exposed services, production workloads, identity systems, CI/CD components, and high-impact assets.
7. Verify remediation or compensating control implementation before closure.
8. Escalate overdue, high-risk, or disputed findings as required.

Inputs

• vulnerability findings
• asset and owner information
• severity and business context
• remediation guidance where available

Outputs / Records

• vulnerability tracking record
• remediation actions
• exception or risk acceptance record where applicable
• closure evidence

Roles and Responsibilities

• [Role] must oversee the vulnerability management process.
• System and service owners must remediate findings affecting their assets.
• Security or platform reviewers must support validation and prioritisation where required.

Escalation / Exceptions

Escalate where:

• a high-risk issue affects production or exposed services
• remediation is overdue or blocked
• there is disagreement on severity or ownership
• a workaround is used instead of full remediation

Exceptions and accepted risks must be documented and approved appropriately.

Related Documents

• Vulnerability and Patch Management Policy
• Patch Management Procedure
• Secure Configuration Standard
• Risk Assessment Procedure

Version Control

Version	Date	Description of Change	Author
0.1 Draft	[DD Month YYYY]	Initial draft.	[Name or Role]