+OPS-25.01AC

OPS-25.01AC

Time frames for the initiation of remediation or mitigation efforts after a vulnerability is identified are defined and monitored according to a risk-based classification framework. This framework incorporates, but is not limited to, the CVSS severity level of vulnerabilities.

Supplementary information

An example of a framework for risk-based classification and definition of time frames can be:

1. Critical (CVSS = 9.0 - 10.0): 24 - 48 hours;

2. High (CVSS = 7.0 - 8.9): 48 - 72 hours;

3. Medium (CVSS = 4.0 - 6.9): 5 days; and

4. Low (CVSS = 0.1 - 3.9): 1 month.

1. Prezentare generală

1.1 Referințe

1.2 Cerințe identificate

1.3 Reglementări asociate

2. Cerințe identificate

Cerințe

3. Reglementări asociate

Reglementări

Tichete legate

Legături
is blocked by Vulnerability Exploitation Analysis
is blocked by Vulnerability Remediation Process