84 lines
2.9 KiB
Markdown
84 lines
2.9 KiB
Markdown
Title: Vulnerability Management Procedure
|
|
Document ID: [PROC-VULN-001]
|
|
Version: 0.1 Draft
|
|
Status: Draft
|
|
Owner: CISO (Paul Jenkins)
|
|
Approver: CISO (Paul Jenkins)
|
|
Classification: Internal
|
|
Effective date: [DD Month YYYY]
|
|
Review date: [DD Month YYYY]
|
|
|
|
# Vulnerability Management Procedure
|
|
|
|
## Purpose
|
|
|
|
This procedure defines how BlackDice should identify, assess, prioritise, track, and close vulnerabilities affecting in-scope assets and services.
|
|
|
|
## Scope
|
|
|
|
This procedure applies to applications, infrastructure, cloud services, Kubernetes environments, endpoints, dependencies, and other in-scope technology assets.
|
|
|
|
## Trigger / When Used
|
|
|
|
Use this procedure when:
|
|
|
|
- new vulnerabilities are identified
|
|
- periodic scanning or review takes place
|
|
- supplier notifications or intelligence indicate exposure
|
|
- incidents, audits, or testing reveal security weaknesses
|
|
|
|
## Procedure Steps
|
|
|
|
1. Collect vulnerability findings from approved sources such as scanning, review, supplier notifications, or manual assessment.
|
|
2. Validate the finding and identify the affected asset, service, version, environment, and owner.
|
|
3. Assess severity using technical characteristics, business context, exposure, exploitability, and service criticality.
|
|
4. Determine the remediation approach, such as patching, configuration change, code fix, compensating control, or risk acceptance.
|
|
5. Record the finding, owner, target date, and status in the approved tracking mechanism.
|
|
6. Prioritise remediation for externally exposed services, production workloads, identity systems, CI/CD components, and high-impact assets.
|
|
7. Verify remediation or compensating control implementation before closure.
|
|
8. Escalate overdue, high-risk, or disputed findings as required.
|
|
|
|
## Inputs
|
|
|
|
- vulnerability findings
|
|
- asset and owner information
|
|
- severity and business context
|
|
- remediation guidance where available
|
|
|
|
## Outputs / Records
|
|
|
|
- vulnerability tracking record
|
|
- remediation actions
|
|
- exception or risk acceptance record where applicable
|
|
- closure evidence
|
|
|
|
## Roles and Responsibilities
|
|
|
|
- [Role] must oversee the vulnerability management process.
|
|
- System and service owners must remediate findings affecting their assets.
|
|
- Security or platform reviewers must support validation and prioritisation where required.
|
|
|
|
## Escalation / Exceptions
|
|
|
|
Escalate where:
|
|
|
|
- a high-risk issue affects production or exposed services
|
|
- remediation is overdue or blocked
|
|
- there is disagreement on severity or ownership
|
|
- a workaround is used instead of full remediation
|
|
|
|
Exceptions and accepted risks must be documented and approved appropriately.
|
|
|
|
## Related Documents
|
|
|
|
- Vulnerability and Patch Management Policy
|
|
- Patch Management Procedure
|
|
- Secure Configuration Standard
|
|
- Risk Assessment Procedure
|
|
|
|
## Version Control
|
|
|
|
| Version | Date | Description of Change | Author |
|
|
| --- | --- | --- | --- |
|
|
| 0.1 Draft | [DD Month YYYY] | Initial draft. | [Name or Role] |
|