6.10. Vulnerability handling and disclosure

(a)

monitor information about vulnerabilities through appropriate channels, such as announcements of CSIRTs, competent authorities or information provided by suppliers or service providers;

(b)

perform, where appropriate, vulnerability scans, and record evidence of the results of the scans, at planned intervals;

(c)

address, without undue delay, vulnerabilities identified by the relevant entities as critical to their operations;

(d)

ensure that their vulnerability handling is compatible with their change management, security patch management, risk management and incident management procedures;

(e)

lay down a procedure for disclosing vulnerabilities in accordance with the applicable national coordinated vulnerability disclosure policy.