6.10.3 When justified by the potential impact of the vulnerability, the relevant entities shall create and …

Requirement

When justified by the potential impact of the vulnerability, the relevant entities shall create and implement a plan to mitigate the vulnerability. In other cases, the relevant entities shall document and substantiate the reason why the vulnerability does not require remediation.

Guidance

• Ensure comprehensive documentation of identified vulnerabilities, the associated risk assessments and any mitigation plans developed.
• Define and establish the roles and responsibilities associated with vulnerability management.
• Mitigation plans should include clear timelines, assigned responsibilities and follow-up procedures.
• All mitigation plans, along with the rationale for non-remediation decisions, should be reviewed and validated by the management body responsible for risk oversight

Examples of evidence

• Records showing timelines and responsible employees for each remediation effort and verification of fixes.
• Records or logs of past vulnerability mitigation plans or schedules.
• Records of any vulnerability that was not addressed and the justification for not addressing it.

1. Prehľad

1.1 Odkazy

1.2 Identifikované požiadavky

1.3 Súvisiace predpisy

2. Identifikované požiadavky

3. Súvisiace predpisy

Prepojené úlohy

• ENISA -

  EN: Publications of the European Union Agency for Cybersecurity (ENISA), https://www.enisa.europa.eu/. © European Union Agency for Cybersecurity (ENISA). Unless otherwise noted, licensed under CC BY 4.0. Changes: divided into sections, converted into the GRCA format and linked to the EU legal acts they refer to; images and material of third parties are not reproduced. Only the versions published by ENISA are authoritative.

  DE: Veröffentlichungen der Agentur der Europäischen Union für Cybersicherheit (ENISA), https://www.enisa.europa.eu/. © European Union Agency for Cybersecurity (ENISA). Soweit nicht anders vermerkt, lizenziert unter CC BY 4.0. Änderungen: in Abschnitte aufgeteilt, in das GRCA-Format umgewandelt und mit den EU-Rechtsakten verknüpft, auf die sie sich beziehen; Bilder und Material Dritter werden nicht wiedergegeben. Maßgeblich sind allein die von der ENISA veröffentlichten Fassungen.