6.10.2 For the purpose of point 6.10.1., the relevant entities shall: (a) monitor information about …

Requirement

For the purpose of point 6.10.1., the relevant entities shall: (a) monitor information about vulnerabilities through appropriate channels, such as announcements of CSIRTs, competent authorities or information provided by suppliers or service providers; (b) perform, where appropriate, vulnerability scans and record evidence of the results of the scans, at planned intervals; (c) address, without undue delay, vulnerabilities identified by the relevant entities as critical to their operations; (d) ensure that their vulnerability handling is compatible with their change management, security patch management, risk management and incident management procedures; (e) lay down a procedure for disclosing vulnerabilities in accordance with the applicable national coordinated vulnerability disclosure policy.

Guidance

• As a minimum, address vulnerabilities assigned to higher classifications (e.g. ‘critical’ and ‘high’ in the CVSS) or equivalent (e.g. as defined by the national CSIRT) without undue delay. Where possible, accepting the risk of such vulnerabilities and not addressing them is not advisable.
• Share information obtained from technical vulnerability scans with designated personnel throughout the entity and with authorities to help eliminate similar vulnerabilities in other information systems.
• Disclose as yet unknown vulnerabilities to designated CSIRTs in accordance with national coordinated vulnerability disclosure (CVD) policies, where applicable.
• Identify a single point of contact and channels for communication with suppliers and service providers about issues related to network and information security.

Examples of evidence

• Logs of a vulnerability assessed as critical to check if it was addressed.
• Licences or subscriptions for vulnerability-scanning tools.
• Configuration files of the vulnerability-scanning tools to ensure they are set up to scan the entire relevant infrastructure and are updated with the latest vulnerability definitions.
• Logs from vulnerability management tools showing scan schedules, results and follow-up actions.
• Documented technical vulnerability scan reports.
• SIEM and EDR/XDR logs for records of detected vulnerabilities and related alerts from monitoring channels.
• Reports from third-party security assessments or penetration tests.
• For vulnerabilities assessed as critical, evidence that findings from these assessments have been addressed.
• Records of any vulnerabilities disclosed, in accordance with the national CVD policy.
• Interview with the single point of contact and channels for communication with suppliers and service providers about information-security-related issues.

1. Übersicht

1.1 Referenzen

1.2 Identifizierte Anforderungen

1.3 Zugehörige Regulierungen

2. Identifizierte Anforderungen

3. Zugehörige Regulierungen

Verknüpfte Vorgänge

• ENISA -