साइबर सुरक्षा GRC 15 आइटम
Vulnerability Management Program Audit
यह चेकलिस्ट अंग्रेज़ी में है।
Audits the maturity of a vulnerability management program covering discovery, prioritization, remediation, and metrics.
NIST 800-53ISO 27001:2022PCI DSS 4.0
मुफ़्त PDF या Word · डाउनलोड करने के लिए अपना ईमेल दर्ज करें।
Program & Asset Coverage
- Is a documented vulnerability management policy defined with roles and SLAs? *
- Is an authoritative asset inventory used to ensure full scan coverage? *
- Are cloud, container, and endpoint assets included in scope? *
Discovery & Scanning
- Are authenticated vulnerability scans performed on a defined schedule? *
- Are external-facing systems scanned at least quarterly? *
- How frequently are internal vulnerability scans performed (days)?
- Is scan tooling kept current with the latest vulnerability signatures? *
Prioritization & Risk Scoring
- Are vulnerabilities prioritized using CVSS and exploitability context (e.g., CISA KEV, EPSS)? *
- Are remediation SLAs defined by severity level? *
- Are risk acceptances for unpatched items documented and approved? *
Remediation & Verification
- Are patches deployed within the defined SLA for critical vulnerabilities? *
- Is remediation verified by rescanning after patching? *
- What percentage of critical vulnerabilities are remediated within SLA?
Reporting & Metrics
- Are vulnerability metrics and trends reported to management? *
- Is mean time to remediate (MTTR) tracked over time? *
पूरी Vulnerability Management Program Audit चेकलिस्ट डाउनलोड करें
इसे साफ़-सुथरे, प्रिंट करने योग्य PDF या संपादन योग्य Word दस्तावेज़ के रूप में मुफ़्त पाएँ।