03.14.01 Flaw Remediation

Statement

• a. Identify, report, and correct system flaws.

• b. Install security-relevant software and firmware updates within {{ insert: param, A.03.14.01.ODP.01 }} of the release of the updates.

Guidance

Organizations identify systems that are affected by announced software and firmware flaws, including potential vulnerabilities that result from those flaws, and report this information to designated personnel with information security responsibilities. Security-relevant updates include patches, service packs, hot fixes, and anti-virus signatures. Organizations address the flaws discovered during security assessments, continuous monitoring, incident response activities, and system error handling. Organizations can take advantage of available resources (e.g., CWE or CVE databases) when remediating system flaws. Organization-defined time periods for updating security-relevant software and firmware may vary based on a variety of factors, including the criticality of the update (i.e., severity of the vulnerability related to the discovered flaw). Some types of flaw remediation may require more testing than other types.

Assessment objective

system flaws are identified.

Assessment objective

system flaws are reported.

Assessment objective

system flaws are corrected.

Assessment objective

security-relevant software updates are installed within {{ insert: param, A.03.14.01.ODP.01 }} of the release of the updates.

Assessment objective

security-relevant firmware updates are installed within {{ insert: param, A.03.14.01.ODP.02 }} of the release of the updates.

Assessment method

• system and information integrity policy and procedures procedures for flaw remediation procedures for configuration management list of recent security flaw remediation actions performed on the system list of flaws and vulnerabilities that may potentially affect the system test results from the installation of software and firmware updates to correct system flaws installation and change control records for security-relevant software and firmware updates system security plan other relevant documents or records

Assessment method

• personnel responsible for installing, configuring, or maintaining the system personnel responsible for flaw remediation personnel with configuration management responsibilities personnel with information security responsibilities system administrators

Assessment method

• processes for identifying, reporting, and correcting system flaws processes for installing software and firmware updates mechanisms for supporting or implementing the reporting and correction of system flaws mechanisms for supporting or implementing the testing software and firmware updates

1. Overzicht

1.1 Referenties

1.2 Geïdentificeerde eisen

1.3 Gerelateerde regelingen

2. Geïdentificeerde eisen

3. Gerelateerde regelingen

Gekoppelde issues

• NIST -

  EN: Publications of the National Institute of Standards and Technology (NIST), U.S. Department of Commerce, https://www.nist.gov/, from their electronic versions (OSCAL; SP 800-63-4 from its HTML version, https://pages.nist.gov/800-63-4/). Works of NIST employees are not subject to copyright protection in the United States (17 U.S.C. § 105); the OSCAL content is dedicated to the public domain worldwide (CC0 1.0); outside the United States NIST grants the right to reprint its technical series publications in all formats (NIST copyright statement). Republished courtesy of the National Institute of Standards and Technology; each document names its citation. Divided into sections and converted into the GRCA format, the wording unchanged. Only the versions published by NIST are authoritative.

  DE: Veröffentlichungen des National Institute of Standards and Technology (NIST), U.S. Department of Commerce, https://www.nist.gov/, aus ihren elektronischen Fassungen (OSCAL; SP 800-63-4 aus ihrer HTML-Fassung, https://pages.nist.gov/800-63-4/). Werke von NIST-Beschäftigten sind in den USA urheberrechtlich nicht geschützt (17 U.S.C. § 105); die OSCAL-Inhalte sind weltweit gemeinfrei gestellt (CC0 1.0); außerhalb der USA räumt das NIST das Recht ein, seine Technical-Series-Publikationen in allen Formaten neu zu veröffentlichen (Copyright-Hinweis des NIST). „Republished courtesy of the National Institute of Standards and Technology“; jedes Dokument nennt seine Zitierangabe. In Abschnitte aufgeteilt und in das GRCA-Format umgewandelt, der Wortlaut unverändert. Maßgeblich sind allein die vom NIST veröffentlichten Fassungen.