Skip to content

Vulnerability & Dependency Management

Vulnerability Detection

Summary

Every dependency, image, and runtime is assessed before deployment and at least weekly afterward, with affected services identifiable from a current component inventory.

Standards

  1. std-sec-vulnerability-detection-01 Every dependency, including a transitive dependency, container image, and runtime MUST be automatically assessed for known vulnerabilities before deployment.
  2. std-sec-vulnerability-detection-02 The components of a deployed service MUST be automatically reassessed at least weekly and when relevant vulnerability information is received.
  3. std-sec-vulnerability-detection-03 Where a new dependency vulnerability is disclosed, affected services MUST be identifiable from a current component inventory, such as a software bill of materials (SBOM).

Implements These Principles

Vulnerability Remediation

Summary

A vulnerability's severity, exploitability, exposure, and impact determine its remediation priority; automated remediation is preferred, and the fix is verified before closure.

Standards

  1. std-sec-vulnerability-remediation-01 A vulnerability MUST be prioritised using its severity, exploitability, exposure, and potential impact, and remediated within the maximum timeframe for its resulting risk rating:

    Risk Rating Maximum Remediation Timeframe
    Critical 14 days
    High 30 days
    Medium 90 days
    Low Next routine dependency update

  2. std-sec-vulnerability-remediation-02 Remediation of a vulnerability MUST be verified, such as by re-scanning the affected dependency, container image, or runtime, before it is considered resolved.

  3. std-sec-vulnerability-remediation-03 Vulnerability remediation SHOULD use automated tooling, such as automated security pull requests.

Implements These Principles

Exceptions

Summary

A vulnerability that cannot meet its remediation timeframe has a documented, time-bound exception and returns to active remediation when that exception expires.

Standards

  1. std-sec-exceptions-01 A vulnerability that cannot be remediated within its applicable risk-based remediation timeframe MUST have a documented, time-bound exception recording its justification, affected assets, compensating controls, and expiration date.
  2. std-sec-exceptions-02 A vulnerability exception MUST expire automatically so the vulnerability returns to active remediation when the exception period lapses.

Implements These Principles