03.14.01 Flaw Remediation

Statement

• a. Identify, report, and correct system flaws.

• b. Install security-relevant software and firmware updates within {{ insert: param, A.03.14.01.ODP.01 }} of the release of the updates.

Guidance

Organizations identify systems that are affected by announced software and firmware flaws, including potential vulnerabilities that result from those flaws, and report this information to designated personnel with information security responsibilities. Security-relevant updates include patches, service packs, hot fixes, and anti-virus signatures. Organizations address the flaws discovered during security assessments, continuous monitoring, incident response activities, and system error handling. Organizations can take advantage of available resources (e.g., CWE or CVE databases) when remediating system flaws. Organization-defined time periods for updating security-relevant software and firmware may vary based on a variety of factors, including the criticality of the update (i.e., severity of the vulnerability related to the discovered flaw). Some types of flaw remediation may require more testing than other types.

Assessment objective

system flaws are identified.

Assessment objective

system flaws are reported.

Assessment objective

system flaws are corrected.

Assessment objective

security-relevant software updates are installed within {{ insert: param, A.03.14.01.ODP.01 }} of the release of the updates.

Assessment objective

security-relevant firmware updates are installed within {{ insert: param, A.03.14.01.ODP.02 }} of the release of the updates.

Assessment method

• system and information integrity policy and procedures procedures for flaw remediation procedures for configuration management list of recent security flaw remediation actions performed on the system list of flaws and vulnerabilities that may potentially affect the system test results from the installation of software and firmware updates to correct system flaws installation and change control records for security-relevant software and firmware updates system security plan other relevant documents or records

Assessment method

• personnel responsible for installing, configuring, or maintaining the system personnel responsible for flaw remediation personnel with configuration management responsibilities personnel with information security responsibilities system administrators

Assessment method

• processes for identifying, reporting, and correcting system flaws processes for installing software and firmware updates mechanisms for supporting or implementing the reporting and correction of system flaws mechanisms for supporting or implementing the testing software and firmware updates

1. Übersicht

1.1 Referenzen

1.2 Identifizierte Anforderungen

1.3 Zugehörige Regulierungen

2. Identifizierte Anforderungen

3. Zugehörige Regulierungen

Verknüpfte Vorgänge

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final