Assessment Objectives
In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that:
- VPM-08_A01 the time period within which to install security-relevant software updates after the release of the updates is defined.
Defined parameters: within thirty (30) days of release of updates
Assessment rigor: 1
Origin: 53A_R5_SI-02_ODP 171A_R3_A.03.14.01.ODP[01] - VPM-08_A02 system flaws are identified.
Assessment rigor: 1
Origin: 53A_R5_SI-02a.[01] 171A_R3_A.03.14.01.a[01] - VPM-08_A03 automated patch management tools are employed to facilitate flaw remediation to components.
Assessment rigor: 1
Origin: 53A_R5_SI-02(04) - VPM-08_A04 system flaws are corrected.
Assessment rigor: 1
Origin: 53A_R5_SI-02a.[03] 171A_R3_A.03.14.01.a[03] - VPM-08_A05 system flaws are reported.
Assessment rigor: 2
Origin: 53A_R5_SI-02a.[02] 171A_R3_A.03.14.01.a[02] - VPM-08_A06 software updates related to flaw remediation are tested for effectiveness before installation.
Assessment rigor: 3
Origin: 53A_R5_SI-02b.[01] - VPM-08_A07 software updates related to flaw remediation are tested for potential side effects before installation.
Assessment rigor: 3
Origin: 53A_R5_SI-02b.[02] - VPM-08_A08 firmware updates related to flaw remediation are tested for effectiveness before installation.
Assessment rigor: 3
Origin: 53A_R5_SI-02b.[03] - VPM-08_A09 firmware updates related to flaw remediation are tested for potential side effects before installation.
Assessment rigor: 3
Origin: 53A_R5_SI-02b.[04] - VPM-08_A10 security-relevant software updates are installed within an organization-defined time period of the release of the updates.
Defined parameters: within thirty (30) days of release of updates
Assessment rigor: 3
Origin: 53A_R5_SI-02c.[01] - VPM-08_A11 security-relevant firmware updates are installed within an organization-defined time period of the release of the updates.
Defined parameters: within thirty (30) days of release of updates
Assessment rigor: 3
Origin: 53A_R5_SI-02c.[02] - VPM-08_A12 flaw remediation is incorporated into the organizational configuration management process.
Assessment rigor: 3
Origin: 53A_R5_SI-02d. - VPM-08_A13 the system components requiring automated patch management tools to facilitate flaw remediation are defined.
Assessment rigor: 3
Origin: 53A_R5_SI-02(04)_ODP - VPM-08_A14 the time period within which to install security-relevant firmware updates after the release of the updates is defined.
Defined parameters: within thirty (30) days of release of updates
Assessment rigor: 2
Origin: 171A_R3_A.03.14.01.ODP[02] - VPM-08_A15 system vulnerabilities are remediated within <A.03.11.02.ODP[03]: response times>.
Defined parameters: thirty (30) days from date of discovery for high-risk vulnerabilities (including both critical and high); 90 days from date of discovery for moderate-risk vulnerabilities; and 180 days from date of discovery for low-risk vulnerabilities
Assessment rigor: NIST 800-171
Origin: 171A_R3_A.03.11.02.b - VPM-08_A16 security-relevant software updates are installed within <A.03.14.01.ODP[01]: time period> of the release of the updates.
Defined parameters: thirty (30) days for high-risk flaws (including both critical and high), 90 days for moderate-risk flaws, and 180 days for low-risk flaws
Assessment rigor: NIST 800-171
Origin: 171A_R3_A.03.14.01.b[01] - VPM-08_A17 security-relevant firmware updates are installed within <A.03.14.01.ODP[02]: time period> of the release of the updates.
Defined parameters: thirty (30) days for high-risk flaws (including both critical and high), 90 days for moderate-risk flaws, and 180 days for low-risk flaws
Assessment rigor: NIST 800-171
Origin: 171A_R3_A.03.14.01.b[02]
Συνδεδεμένα ζητήματα
| Τύπος σύνδεσης | Ζήτημα |
|---|---|
| blocks | Software & Firmware Patching |
- Secure Controls Framework -
EN: GRCA includes the Secure Controls Framework® (SCF) content, © Secure Controls Framework Council, LLC, used under the Creative Commons Attribution-NoDerivatives 4.0 International Public License. SCF control numbers, names, descriptions and mappings appear exactly as published by the SCF Council – https://securecontrolsframework.com. GRCA may group or reorder SCF content for display, which does not change SCF content; the mappings are shown as links to the frameworks they name. Learn more at https://securecontrolsframework.com.
DE: GRCA enthält Inhalte des Secure Controls Framework® (SCF), © Secure Controls Framework Council, LLC, genutzt unter der Creative Commons Attribution-NoDerivatives 4.0 International Public License. Nummern, Namen, Beschreibungen und Zuordnungen der SCF-Controls erscheinen genau so, wie der SCF Council sie veröffentlicht – https://securecontrolsframework.com. GRCA gruppiert oder sortiert SCF-Inhalte für die Anzeige, ohne sie zu verändern; die Zuordnungen erscheinen als Verknüpfungen zu den genannten Regelwerken. Mehr unter https://securecontrolsframework.com.