حوكمة ومخاطر وامتثال الأمن السيبراني (GRC) 15 بند
Vulnerability Management Program Audit
قائمة التحقق هذه باللغة الإنجليزية.
Audits the maturity of a vulnerability management program covering discovery, prioritization, remediation, and metrics.
NIST 800-53ISO 27001:2022PCI DSS 4.0
PDF أو Word مجانًا · أدخل بريدك الإلكتروني للتنزيل.
Program & Asset Coverage
- Is a documented vulnerability management policy defined with roles and SLAs? *
- Is an authoritative asset inventory used to ensure full scan coverage? *
- Are cloud, container, and endpoint assets included in scope? *
Discovery & Scanning
- Are authenticated vulnerability scans performed on a defined schedule? *
- Are external-facing systems scanned at least quarterly? *
- How frequently are internal vulnerability scans performed (days)?
- Is scan tooling kept current with the latest vulnerability signatures? *
Prioritization & Risk Scoring
- Are vulnerabilities prioritized using CVSS and exploitability context (e.g., CISA KEV, EPSS)? *
- Are remediation SLAs defined by severity level? *
- Are risk acceptances for unpatched items documented and approved? *
Remediation & Verification
- Are patches deployed within the defined SLA for critical vulnerabilities? *
- Is remediation verified by rescanning after patching? *
- What percentage of critical vulnerabilities are remediated within SLA?
Reporting & Metrics
- Are vulnerability metrics and trends reported to management? *
- Is mean time to remediate (MTTR) tracked over time? *
نزّل قائمة تحقق Vulnerability Management Program Audit كاملة
احصل عليها مجانًا بصيغة PDF أنيقة قابلة للطباعة أو مستند Word قابل للتعديل.