+Testing and Documentation of known Vulnerabilities

Testing and Documentation of known Vulnerabilities

System components in the area of responsibility of the Cloud Service Provider for the provision of the cloud service are automatically checked for known vulnerabilities at least once a month in accordance with the policies for handling vulnerabilities (cf. OPS-18), the severity is assessed in accordance with defined criteria and measures for timely remediation or mitigation are initiated within defined time windows.
Additonal CriteriaAvailable security patches are applied depending on the severity of the vulnerabilities, as determined based on the latest version of the Common Vulnerability Scoring System (CVSS):
• Critical (CVSS = 9.0 - 10.0): 3 hours;
• High (CVSS = 7.0 - 8.9): 3 days;
• Average (CVSS = 4.0 - 6.9): 1 month;
• Low (CVSS = 0.1 - 3.9): 3 months.
Supplementary Information - About the CriteriaIn contrast to penetration tests (Cf. OPS20), which are carried out manually and according to an individual scheme, the check for open vulnerabilities is performed automatically, using socalled vulnerability scanners.

1. Översikt

1.1 Referenser

1.2 Identifierade krav

1.3 Relaterade regleringar

2. Identifierade krav

Krav

3. Relaterade regleringar

Regleringar