Assessment Objectives

In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that:

• VPM-01_A01 a formal, documented vulnerability and patch management policy is approved by executive management, or a formally delegated authority, and conveys executive management's intent for vulnerability and patch management.
  Assessment rigor: 1
  Origin: SCF Created
• VPM-01_A02 the vulnerability and patch management policy provides organizational direction and states the behaviors expected of personnel and other applicable parties with respect to vulnerability and patch management.
  Assessment rigor: 1
  Origin: SCF Created
• VPM-01_A03 the current version of the vulnerability and patch management policy is communicated to, and accessible by, the personnel and other applicable parties who are expected to comply with it.
  Assessment rigor: 1
  Origin: SCF Created
• VPM-01_A04 the vulnerability and patch management policy is reviewed at least annually.
  Defined parameters: at least annually
  Assessment rigor: 1
  Origin: SCF Created
• VPM-01_A05 the vulnerability and patch management policy is updated, as necessary, in response to changes in risks, threats, business practices and/or statutory, regulatory and contractual obligations that affect the organization.
  Assessment rigor: 1
  Origin: SCF Created

Prepojené úlohy

• Secure Controls Framework -

  EN: GRCA includes the Secure Controls Framework® (SCF) content, © Secure Controls Framework Council, LLC, used under the Creative Commons Attribution-NoDerivatives 4.0 International Public License. SCF control numbers, names, descriptions and mappings appear exactly as published by the SCF Council – https://securecontrolsframework.com. GRCA may group or reorder SCF content for display, which does not change SCF content; the mappings are shown as links to the frameworks they name. Learn more at https://securecontrolsframework.com.

  DE: GRCA enthält Inhalte des Secure Controls Framework® (SCF), © Secure Controls Framework Council, LLC, genutzt unter der Creative Commons Attribution-NoDerivatives 4.0 International Public License. Nummern, Namen, Beschreibungen und Zuordnungen der SCF-Controls erscheinen genau so, wie der SCF Council sie veröffentlicht – https://securecontrolsframework.com. GRCA gruppiert oder sortiert SCF-Inhalte für die Anzeige, ohne sie zu verändern; die Zuordnungen erscheinen als Verknüpfungen zu den genannten Regelwerken. Mehr unter https://securecontrolsframework.com.