VER-EVA-EFA Evaluation Factors

Providers SHOULD consider at least the following factors when considering the context of the cloud service offering to evaluate detected vulnerabilities:

• Criticality: How important are the systems or information that might be impacted by the vulnerability?
• Reachability: How might a threat actor reach the vulnerability and how likely is that?
• Exploitability: How easy is it for a threat actor to exploit the vulnerability and how likely is that?
• Detectability: How easy is it for a threat actor to become aware of the vulnerability and how likely is that?
• Prevalence: How much of the cloud service offering is affected by the vulnerability?
• Privilege: How much privileged authority or access is granted or can be gained from exploiting the vulnerability?
• Proximate Vulnerabilities: How does this vulnerability interact with previously detected vulnerabilities, especially partially or fully mitigated vulnerabilities?
• Known Threats: How might already known threats leverage the vulnerability and how likely is that?

NIST SP 800-53 Rev. 5 controls: RA-9

Defined terms: Cloud Service Offering, Fully Mitigated Vulnerability, Likely, Vulnerability, Vulnerability Detection

1. Overzicht

1.1 Referenties

• RA-09 Criticality Analysis
• FRD-CSO Cloud Service Offering
• FRD-FMV Fully Mitigated Vulnerability
• FRD-LKY Likely
• FRD-VUL Vulnerability
• FRD-VLD Vulnerability Detection

1.2 Geïdentificeerde eisen

1.3 Gerelateerde regelingen

2. Geïdentificeerde eisen

3. Gerelateerde regelingen

• FedRAMP Consolidated Rules -

  EN: FedRAMP® Consolidated Rules of the Federal Risk and Authorization Management Program, U.S. General Services Administration (GSA), https://www.fedramp.gov/, from their machine-readable version (FedRAMP/rules). Works of the U.S. Government are not subject to copyright protection in the United States (17 U.S.C. § 105; GSA website policies); GSA dedicated its machine-readable FedRAMP content to the public domain worldwide (CC0 1.0). FedRAMP® is a registered trademark of GSA; GRCA is not affiliated with, nor endorsed by, GSA or FedRAMP. Divided into sections and converted into the GRCA format, the wording unchanged, linked to the NIST SP 800-53 controls they name. Only the version published by FedRAMP is authoritative.

  DE: FedRAMP® Consolidated Rules des Federal Risk and Authorization Management Program, U.S. General Services Administration (GSA), https://www.fedramp.gov/, aus ihrer maschinenlesbaren Fassung (FedRAMP/rules). Werke der US-Regierung sind in den USA urheberrechtlich nicht geschützt (17 U.S.C. § 105; Website-Richtlinien der GSA); die GSA hat ihre maschinenlesbaren FedRAMP-Inhalte weltweit gemeinfrei gestellt (CC0 1.0). FedRAMP® ist eine eingetragene Marke der GSA; GRCA steht in keiner Verbindung zur GSA oder zu FedRAMP und wird von ihnen nicht unterstützt. In Abschnitte aufgeteilt und in das GRCA-Format umgewandelt, der Wortlaut unverändert, mit den genannten Controls aus NIST SP 800-53 verknüpft. Maßgeblich ist allein die von FedRAMP veröffentlichte Fassung.