RV.1.1 Gather information from software acquirers, users, and public sources on potential vulnerabilities in the software and third-party components that …

Statement

Gather information from software acquirers, users, and public sources on potential vulnerabilities in the software and third-party components that the software uses, and investigate all credible reports.

Example 1:

Monitor vulnerability databases , security mailing lists, and other sources of vulnerability reports through manual or automated means.

Example 2:

Use threat intelligence sources to better understand how vulnerabilities in general are being exploited.

Example 3:

Automatically review provenance and software composition data for all software components to identify any new vulnerabilities they have.

1. Przegląd

1.1 Odwołania

1.2 Zidentyfikowane wymagania

1.3 Powiązane regulacje

2. Zidentyfikowane wymagania

3. Powiązane regulacje

Powiązane zgłoszenia

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final