Gestão de Vulnerabilidades
Identificar e gerir vulnerabilidades em ativos organizacionais.
Gestão de Vulnerabilidades é definido pelos resultados do NIST CSF 2.0 ID.RA-01 (Vulnerabilities in assets are identified, validated, and recorded); ID.RA-08 (Processes for receiving, analyzing, and responding to vulnerability disclosures are established). Correspondência Mapeado por meio de um crosswalk publicado em ISO 27001, CIS v8.1, PCI DSS, CMMC, 800-53, HIPAA e NIS2. Editorial Mapeado editorialmente em SOC 2, GDPR, Essential Eight, DORA, CPS 234 e Cyber Essentials.
| Framework | Requisito | Título | Vínculo | Fonte / motivo |
|---|---|---|---|---|
| NIST CSF 2.0 | ID.RA-01ID.RA-08 | Vulnerabilities in assets are identified, validated, and recorded; Processes for receiving, analyzing, and responding to vulnerability disclosures are established | Definição do tópico | ID.RA-01 ID.RA-08 |
| ISO 27001 | A.8.8 | Management of technical vulnerabilities | Correspondência | A.8.8: via ID.RA-01; NIST 800-53 map: RA-5 |
| CIS v8.1 | CIS 7.1CIS 7.2CIS 7.5CIS 7.6CIS 7.7CIS 16.6CIS 18.1CIS 18.2CIS 18.3CIS 18.4CIS 18.5 | Establish and Maintain a Vulnerability Management Process; Establish and Maintain a Remediation Process; Perform Automated Vulnerability Scans of Internal Enterprise Assets… | Correspondência | CIS 7.1: via ID.RA-01 CIS 7.2: via ID.RA-08 CIS 7.5: Editorial (CIS's published crosswalk covers 49 of 153 safeguards): automated vulnerability scans of internal assets. CIS 7.6: Editorial (CIS's published crosswalk covers 49 of 153 safeguards): automated vulnerability scans of external assets. CIS 7.7: Editorial (CIS's published crosswalk covers 49 of 153 safeguards): remediate detected vulnerabilities. CIS 16.6: Editorial (CIS's published crosswalk covers 49 of 153 safeguards): a severity rating process for application vulnerabilities. CIS 18.1: Editorial (CIS's published crosswalk covers 49 of 153 safeguards): a penetration testing programme. CIS 18.2: Editorial (CIS's published crosswalk covers 49 of 153 safeguards): periodic external penetration tests. CIS 18.3: Editorial (CIS's published crosswalk covers 49 of 153 safeguards): remediate penetration test findings. CIS 18.4: Editorial (CIS's published crosswalk covers 49 of 153 safeguards): validate security measures after penetration tests. CIS 18.5: Editorial (CIS's published crosswalk covers 49 of 153 safeguards): periodic internal penetration tests. |
| SOC 2 | CC7.1 | Detecting configuration changes and new vulnerabilities | Editorial | CC7.1: AICPA's TSC mappings are not openly licensed; ControlMapping editorial mapping (criterion summaries are ours, not AICPA text). |
| PCI DSS | 6.3.111.3.111.3.2 | Vulnerabilities identified and risk-ranked; Internal vulnerability scans every three months; External ASV scans every three months | Correspondência | 6.3.1: via ID.RA-01 11.3.1: via ID.RA-01 11.3.2: via ID.RA-01 |
| CMMC | RA.L2-3.11.2RA.L2-3.11.3 | Vulnerability Scan; Vulnerability Remediation | Correspondência | RA.L2-3.11.2: via 800-171r3 03.11.02 ↔ ID.RA-01, ID.RA-08 → RA-5; 800-171r2 Appendix D → RA-5 RA.L2-3.11.3: via 800-171r3 03.11.02 ↔ ID.RA-01, ID.RA-08 → RA-5; 800-171r2 Appendix D → RA-5 |
| 800-53 | RA-5CA-8 | Vulnerability Monitoring and Scanning; Penetration Testing | Correspondência | RA-5: via ID.RA-01; ID.RA-08 CA-8: via ID.RA-01 |
| HIPAA | §164.308(a)(1)(ii)(A)§164.308(a)(1)(ii)(B)§164.308(a)(8) | Risk Analysis; Risk Management; Evaluation | Correspondência | §164.308(a)(1)(ii)(A): The HIPAA risk analysis must identify vulnerabilities to ePHI; HHS guidance treats vulnerability identification as part of it. §164.308(a)(1)(ii)(B): Risk management requires reducing identified risks and vulnerabilities to a reasonable level, which is where remediation sits in HIPAA. §164.308(a)(8): via NIST HIPAA map: CA-8 |
| GDPR | Art.32(1)(d) | Security of processing | Editorial | Art.32(1)(d): No official crosswalk exists for GDPR; ControlMapping editorial mapping. |
| NIS2 | 6.56.10 | Security testing; Vulnerability handling and disclosure | Correspondência | 6.5: via ID.RA-01 6.10: via ID.RA-01; ID.RA-08; ENISA ISO map: A.8.8 |
| Essential Eight | ISM-1807ISM-1808ISM-1698ISM-1699ISM-1701ISM-1702 | An automated method of asset discovery is used at least fortnightly to support the…; A vulnerability scanner with an up-to-date vulnerability database is used for…; A vulnerability scanner is used at least daily to identify missing patches or updates for vulnerabilities in online…… | Editorial | ASD assigns these ISM controls to the Essential Eight; ASD publishes no crosswalk to NIST or ISO, so linking them to topics is ControlMapping editorial. |
| DORA | Art.8(2)Art.25(1)Art.26(1)Art.27(1) | Identification; Testing of ICT tools and systems; Advanced testing of ICT tools, systems and processes based on TLPT… | Editorial | Art.8(2): Assess ICT vulnerabilities on a continuous basis. Art.25(1): Testing includes vulnerability assessments and scans, and penetration testing. Art.26(1): Entities selected by their authority run threat-led penetration testing (TLPT) at least every three years. Art.27(1): Testers carrying out TLPT must be suitable, technically capable, certified or bound by a code of conduct, and insured. |
| CPS 234 | Para 17Para 27Para 30 | Keep capability current as threats and vulnerabilities change; Systematic testing programme for control effectiveness; Testing by skilled, functionally independent specialists | Editorial | Para 17: Actively maintain the security capability as vulnerabilities change. Para 27: A systematic testing programme whose frequency follows how fast vulnerabilities and threats change. Para 30: Testing by appropriately skilled and functionally independent specialists. |
| Cyber Essentials | CE 3 | Security Update Management | Editorial | CE 3: Fix known vulnerabilities: updates rated critical or high risk (CVSS v3 7 or above) within 14 days, and no unsupported software. |
Definição do tópico Resultados do CSF 2.0 que definem este tópico · Correspondência pelo menos uma escolha respaldada por um crosswalk publicado · Editorial Juízo editorial da ControlMapping, com a justificação · não mapeado, compartilha apenas os resultados do CSF deste tópico · Sem mapeamento em nossos dados nada mapeado em nossos dados; muitas vezes é trabalho novo, mas verifique as notas de cobertura. Metodologia.
Os IDs e títulos dos requisitos são exibidos como cada framework os publica, em inglês.
Mapeamento incorreto ou ausente? Reportar
Sobre Gestão de Vulnerabilidades
A gestão de vulnerabilidades é um processo contínuo de descoberta, priorização e remediação de fraquezas de segurança na infraestrutura, nas aplicações e nos endpoints de uma organização. Programas eficazes utilizam ferramentas de varredura automatizadas para identificar vulnerabilidades, priorização baseada em risco (como pontuações CVSS combinadas com a criticidade do ativo e a disponibilidade de exploits) para concentrar os esforços de remediação, e SLAs definidos para os prazos de aplicação de patches. Avaliações de vulnerabilidade regulares e testes de penetração validam que os esforços de remediação são eficazes e que novas vulnerabilidades são identificadas prontamente.