6.10.4 The relevant entities shall review and, where appropriate, update at planned intervals the channels …

Requirement

The relevant entities shall review and, where appropriate, update at planned intervals the channels they use for monitoring vulnerability information.

Guidance

• Review the information from the technical-vulnerability-monitoring channels at least biannually.
• Consider inventorying sources likely to report technical vulnerabilities in the identified components and distribute updates (software publisher websites, CERT website and ENISA website) (71).

Examples of evidence

• List of monitoring channels for technical vulnerabilities, including suppliers and service providers’ single points of contact.
• Records of past reviews and plans for future reviews of technical vulnerability channels.
• Subscriptions to relevant vulnerability notification services, mailing lists and alert systems (e.g. CERT, vendor advisories and security forums).
• Logs that document periodic reviews of the monitoring channels to verify that they are up to date and effective.
• Records of alerts or notifications received from monitoring channels about new vulnerabilities, including how these alerts were handled and any subsequent actions taken.
• Logs that record the monitoring activities for vulnerability information, including dates and sources monitored (e.g. security advisories, vendor bulletins, threat intelligence feeds).

Tips: guidance

• Create and maintain procedures for identifying, assessing, prioritising and remediating vulnerabilities.
• Make sure that suppliers and service providers report vulnerabilities in their systems or products or services that present a risk to the security of the network and information systems of the entity.
• Perform vulnerability scans and record evidence of the results of the scans, when significant incidents or significant changes to operations or risks occur.
• Where possible, consider authenticated vulnerability or an alternative method to perform in depth scans.
• Review and, where appropriate, update the channels for monitoring vulnerability information when significant incidents or significant changes to operations or risks occur.

Tips: examples of evidence

• Documented procedures for identifying, assessing, prioritising and remediating vulnerabilities.
• Contracts with suppliers and service providers that require technical vulnerability reporting, handling and disclosure.
• Vulnerability-related communications or reports from suppliers and service providers.
• Records of ad-hoc scans performed in response to significant incidents or changes to the infrastructure, including the dates and reasons for these scans.
• Change management logs to verify that vulnerability scans are conducted following significant incidents or changes to the infrastructure or to the threat landscape.
• Records of internal audits or reviews of the vulnerability management procedures.
• Findings and corrective actions taken from these audits.

1. Przegląd

1.1 Odwołania

1.2 Zidentyfikowane wymagania

1.3 Powiązane regulacje

2. Zidentyfikowane wymagania

3. Powiązane regulacje

Powiązane zgłoszenia

• ENISA -