Gestione delle vulnerabilità
Identificare e gestire le vulnerabilità negli asset dell'organizzazione.
Gestione delle vulnerabilità è definito dagli esiti ID.RA-01 (Vulnerabilities in assets are identified, validated, and recorded); ID.RA-08 (Processes for receiving, analyzing, and responding to vulnerability disclosures are established) di NIST CSF 2.0. Crosswalk Mappato tramite un crosswalk pubblicato in ISO 27001, CIS v8.1, PCI DSS, CMMC, 800-53, HIPAA e NIS2. Redazione Mappato in modo editoriale in SOC 2, GDPR, Essential Eight, DORA, CPS 234 e Cyber Essentials.
| Framework | Requisito | Titolo | Collegamento | Fonte / motivo |
|---|---|---|---|---|
| NIST CSF 2.0 | ID.RA-01ID.RA-08 | Vulnerabilities in assets are identified, validated, and recorded; Processes for receiving, analyzing, and responding to vulnerability disclosures are established | Definizione dell'argomento | ID.RA-01 ID.RA-08 |
| ISO 27001 | A.8.8 | Management of technical vulnerabilities | Crosswalk | A.8.8: via ID.RA-01; NIST 800-53 map: RA-5 |
| CIS v8.1 | CIS 7.1CIS 7.2CIS 7.5CIS 7.6CIS 7.7CIS 16.6CIS 18.1CIS 18.2CIS 18.3CIS 18.4CIS 18.5 | Establish and Maintain a Vulnerability Management Process; Establish and Maintain a Remediation Process; Perform Automated Vulnerability Scans of Internal Enterprise Assets… | Crosswalk | CIS 7.1: via ID.RA-01 CIS 7.2: via ID.RA-08 CIS 7.5: Editorial (CIS's published crosswalk covers 49 of 153 safeguards): automated vulnerability scans of internal assets. CIS 7.6: Editorial (CIS's published crosswalk covers 49 of 153 safeguards): automated vulnerability scans of external assets. CIS 7.7: Editorial (CIS's published crosswalk covers 49 of 153 safeguards): remediate detected vulnerabilities. CIS 16.6: Editorial (CIS's published crosswalk covers 49 of 153 safeguards): a severity rating process for application vulnerabilities. CIS 18.1: Editorial (CIS's published crosswalk covers 49 of 153 safeguards): a penetration testing programme. CIS 18.2: Editorial (CIS's published crosswalk covers 49 of 153 safeguards): periodic external penetration tests. CIS 18.3: Editorial (CIS's published crosswalk covers 49 of 153 safeguards): remediate penetration test findings. CIS 18.4: Editorial (CIS's published crosswalk covers 49 of 153 safeguards): validate security measures after penetration tests. CIS 18.5: Editorial (CIS's published crosswalk covers 49 of 153 safeguards): periodic internal penetration tests. |
| SOC 2 | CC7.1 | Detecting configuration changes and new vulnerabilities | Redazione | CC7.1: AICPA's TSC mappings are not openly licensed; ControlMapping editorial mapping (criterion summaries are ours, not AICPA text). |
| PCI DSS | 6.3.111.3.111.3.2 | Vulnerabilities identified and risk-ranked; Internal vulnerability scans every three months; External ASV scans every three months | Crosswalk | 6.3.1: via ID.RA-01 11.3.1: via ID.RA-01 11.3.2: via ID.RA-01 |
| CMMC | RA.L2-3.11.2RA.L2-3.11.3 | Vulnerability Scan; Vulnerability Remediation | Crosswalk | RA.L2-3.11.2: via 800-171r3 03.11.02 ↔ ID.RA-01, ID.RA-08 → RA-5; 800-171r2 Appendix D → RA-5 RA.L2-3.11.3: via 800-171r3 03.11.02 ↔ ID.RA-01, ID.RA-08 → RA-5; 800-171r2 Appendix D → RA-5 |
| 800-53 | RA-5CA-8 | Vulnerability Monitoring and Scanning; Penetration Testing | Crosswalk | RA-5: via ID.RA-01; ID.RA-08 CA-8: via ID.RA-01 |
| HIPAA | §164.308(a)(1)(ii)(A)§164.308(a)(1)(ii)(B)§164.308(a)(8) | Risk Analysis; Risk Management; Evaluation | Crosswalk | §164.308(a)(1)(ii)(A): The HIPAA risk analysis must identify vulnerabilities to ePHI; HHS guidance treats vulnerability identification as part of it. §164.308(a)(1)(ii)(B): Risk management requires reducing identified risks and vulnerabilities to a reasonable level, which is where remediation sits in HIPAA. §164.308(a)(8): via NIST HIPAA map: CA-8 |
| GDPR | Art.32(1)(d) | Security of processing | Redazione | Art.32(1)(d): No official crosswalk exists for GDPR; ControlMapping editorial mapping. |
| NIS2 | 6.56.10 | Security testing; Vulnerability handling and disclosure | Crosswalk | 6.5: via ID.RA-01 6.10: via ID.RA-01; ID.RA-08; ENISA ISO map: A.8.8 |
| Essential Eight | ISM-1807ISM-1808ISM-1698ISM-1699ISM-1701ISM-1702 | An automated method of asset discovery is used at least fortnightly to support the…; A vulnerability scanner with an up-to-date vulnerability database is used for…; A vulnerability scanner is used at least daily to identify missing patches or updates for vulnerabilities in online…… | Redazione | ASD assigns these ISM controls to the Essential Eight; ASD publishes no crosswalk to NIST or ISO, so linking them to topics is ControlMapping editorial. |
| DORA | Art.8(2)Art.25(1)Art.26(1)Art.27(1) | Identification; Testing of ICT tools and systems; Advanced testing of ICT tools, systems and processes based on TLPT… | Redazione | Art.8(2): Assess ICT vulnerabilities on a continuous basis. Art.25(1): Testing includes vulnerability assessments and scans, and penetration testing. Art.26(1): Entities selected by their authority run threat-led penetration testing (TLPT) at least every three years. Art.27(1): Testers carrying out TLPT must be suitable, technically capable, certified or bound by a code of conduct, and insured. |
| CPS 234 | Para 17Para 27Para 30 | Keep capability current as threats and vulnerabilities change; Systematic testing programme for control effectiveness; Testing by skilled, functionally independent specialists | Redazione | Para 17: Actively maintain the security capability as vulnerabilities change. Para 27: A systematic testing programme whose frequency follows how fast vulnerabilities and threats change. Para 30: Testing by appropriately skilled and functionally independent specialists. |
| Cyber Essentials | CE 3 | Security Update Management | Redazione | CE 3: Fix known vulnerabilities: updates rated critical or high risk (CVSS v3 7 or above) within 14 days, and no unsupported software. |
Definizione dell'argomento Risultati CSF 2.0 che definiscono questo tema · Crosswalk almeno una scelta supportata da una tabella di corrispondenza pubblicata · Redazione Giudizio di ControlMapping, con la motivazione · non mappato, condivide solo gli esiti CSF di questo argomento · Nessuna mappatura nei nostri dati nessuna mappatura nei nostri dati; spesso si tratta di lavoro nuovo, ma verifica le note sulla copertura. Metodologia.
ID e titoli dei requisiti sono riportati come ciascun framework li pubblica, in inglese.
Mappatura errata o mancante? Segnalalo
Informazioni su Gestione delle vulnerabilità
La gestione delle vulnerabilità è un processo continuo di individuazione, prioritizzazione e rimedio delle debolezze di sicurezza nell'infrastruttura, nelle applicazioni e negli endpoint di un'organizzazione. I programmi efficaci utilizzano strumenti di scansione automatizzati per identificare le vulnerabilità, una prioritizzazione basata sul rischio (ad esempio punteggi CVSS combinati con la criticità degli asset e la disponibilità di exploit) per concentrare gli interventi di rimedio, e SLA definiti per i tempi di applicazione delle patch. Le valutazioni periodiche delle vulnerabilità e i penetration test verificano che gli interventi di rimedio siano efficaci e che le nuove vulnerabilità vengano individuate tempestivamente.