+OPS-25.01AC

OPS-25.01AC

Time frames for the initiation of remediation or mitigation efforts after a vulnerability is identified are defined and monitored according to a risk-based classification framework. This framework incorporates, but is not limited to, the CVSS severity level of vulnerabilities.

Supplementary information

An example of a framework for risk-based classification and definition of time frames can be:

1. Critical (CVSS = 9.0 - 10.0): 24 - 48 hours;

2. High (CVSS = 7.0 - 8.9): 48 - 72 hours;

3. Medium (CVSS = 4.0 - 6.9): 5 days; and

4. Low (CVSS = 0.1 - 3.9): 1 month.

1. Visão geral

1.1 Referências

1.2 Requisitos identificados

1.3 Regulamentos relacionados

2. Requisitos identificados

Requisitos

3. Regulamentos relacionados

Regulamentos

Pedidos ligados

Ligações
is blocked by Vulnerability Exploitation Analysis
is blocked by Vulnerability Remediation Process