Vulnerability management
Every dependency and running Version is scanned daily, and each known vulnerability is fixed within its severity deadline.
Satisfies
| Criterion | Text |
|---|---|
| SOC2 CC7.1 | The entity uses detection and monitoring to identify configuration changes and newly discovered vulnerabilities. |
| ISO27001 A.8.8 | Information about technical vulnerabilities is obtained, exposure is evaluated, and measures are taken. |
Implemented by
Test
| Step | Rule |
|---|---|
| Kind | Detective: it finds the failure after it happens. |
| Select | Every vulnerability the daily scan finds in the report period. |
| Assert | Each closed through a merged Change within its severity deadline, or through a Decision accepting the risk. |
Owner
Security Engineer, Engineering Team.
Example
Daily scanning finds a high-severity flaw in an invoice-parsing API's PDF library. A merged Change upgrades it in 3 days, inside the 7-day deadline.