ER-58 Sample - Vulnerability Scans and Remediation for a Sample of [Quarters and Months]

Evidence of Vulnerability Scan Results for a Sample

Provide the vulnerability scan results for each sample selected.

Evidence of Vulnerability Scan Remediation for a Sample

If any Critical or High vulnerabilities are identified, provide formal documentation demonstrating the remediation plans have been documented and the status of these plans (e.g., Remediated, In Progress, etc.).

Additional Guidance

Depending on how your environment and controls are set up, you might be providing slightly different evidence for this control. The most common situations are:

Internal and external vulnerability scanning

In this scenario, vulnerability scanning is being performed on the in-scope production infrastructure resources (e.g., virtual machines) on a set frequency (e.g., monthly, quarterly) and remediation is taking place according to the company’s policy.

Application code scanning

In this situation, application code vulnerability scanning is being performed on any code that is being implemented and remediation of all high and critical identified vulnerabilities is completed prior to the code moving to production.