RV.1 Identify and Confirm Vulnerabilities on an Ongoing Basis

Statement

Gather information from software acquirers, users, and public sources on potential vulnerabilities in the software and third-party components that the software uses, and investigate all credible reports.

Example 1:

Monitor vulnerability databases , security mailing lists, and other sources of vulnerability reports through manual or automated means.

Example 2:

Use threat intelligence sources to better understand how vulnerabilities in general are being exploited.

Example 3:

Automatically review provenance and software composition data for all software components to identify any new vulnerabilities they have.

Statement

Review, analyze, and/or test the software’s code to identify or confirm the presence of previously undetected vulnerabilities.

Example 1:

Configure the toolchain to perform automated code analysis and testing on a regular or continuous basis for all supported releases.

Example 2:

See PW.7 and PW.8.

Statement

Have a policy that addresses vulnerability disclosure and remediation, and implement the roles, responsibilities, and processes needed to support that policy.

Example 1:

Establish a vulnerability disclosure program, and make it easy for security researchers to learn about your program and report possible vulnerabilities.

Example 2:

Have a Product Security Incident Response Team (PSIRT) and processes in place to handle the responses to vulnerability reports and incidents, including communications plans for all stakeholders.

Example 3:

Have a security response playbook to handle a generic reported vulnerability, a report of zero-days, a vulnerability being exploited in the wild, and a major ongoing incident involving multiple parties and open-source software components.

Example 4:

Periodically conduct exercises of the product security incident response processes.