RV.1.1 Gather information from software acquirers, users, and public sources on potential vulnerabilities in the software and third-party components that …

Statement

Gather information from software acquirers, users, and public sources on potential vulnerabilities in the software and third-party components that the software uses, and investigate all credible reports.

Example 1:

Monitor vulnerability databases , security mailing lists, and other sources of vulnerability reports through manual or automated means.

Example 2:

Use threat intelligence sources to better understand how vulnerabilities in general are being exploited.

Example 3:

Automatically review provenance and software composition data for all software components to identify any new vulnerabilities they have.

1. Übersicht

1.1 Referenzen

1.2 Identifizierte Anforderungen

1.3 Zugehörige Regulierungen

2. Identifizierte Anforderungen

3. Zugehörige Regulierungen

Verknüpfte Vorgänge

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final