ER-58 Vulnerability Scans and Remediation for a Sample of [Quarters and Months]

What to Provide

(1) Evidence of the vulnerability scan results for the sampled quarters/months.

(2) Evidence of remediation actions taken for any high and/or critical vulnerabilities identified during the sampled quarterly/monthly vulnerability scans.

Evidence Format

Exported documents in a common file type such as .docx, .csv, or .pdf or screenshots or exported images in a common image file type such as .jpg, .png, or .pdf.

Additional Guidance

Depending on how your environment and controls are set up, you might be providing slightly different evidence for this control. The most common situations are:

Internal and external vulnerability scanning

In this scenario, vulnerability scanning is being performed on the in-scope production infrastructure resources (e.g., virtual machines) on a set frequency (e.g., monthly, quarterly) and remediation is taking place according to the company’s policy.

Application code scanning

In this situation, application code vulnerability scanning is being performed on any code that is being implemented and remediation of all high and critical identified vulnerabilities is completed prior to the code moving to production.

NOTE: If the vulnerability scanning tool utilized is scanning at a continuous frequency, please provide evidence demonstrating that the tool is configured to scan continuously. If this is set by default and non-configurable, please provide supporting vendor documentation detailing this default frequency.