网络安全 GRC 15 项
Vulnerability Management Program Audit
此检查清单为英文版。
Audits the maturity of a vulnerability management program covering discovery, prioritization, remediation, and metrics.
NIST 800-53ISO 27001:2022PCI DSS 4.0
免费 PDF 或 Word · 输入邮箱即可下载。
Program & Asset Coverage
- Is a documented vulnerability management policy defined with roles and SLAs? *
- Is an authoritative asset inventory used to ensure full scan coverage? *
- Are cloud, container, and endpoint assets included in scope? *
Discovery & Scanning
- Are authenticated vulnerability scans performed on a defined schedule? *
- Are external-facing systems scanned at least quarterly? *
- How frequently are internal vulnerability scans performed (days)?
- Is scan tooling kept current with the latest vulnerability signatures? *
Prioritization & Risk Scoring
- Are vulnerabilities prioritized using CVSS and exploitability context (e.g., CISA KEV, EPSS)? *
- Are remediation SLAs defined by severity level? *
- Are risk acceptances for unpatched items documented and approved? *
Remediation & Verification
- Are patches deployed within the defined SLA for critical vulnerabilities? *
- Is remediation verified by rescanning after patching? *
- What percentage of critical vulnerabilities are remediated within SLA?
Reporting & Metrics
- Are vulnerability metrics and trends reported to management? *
- Is mean time to remediate (MTTR) tracked over time? *
下载完整的Vulnerability Management Program Audit检查清单
免费获取排版清晰、便于打印的 PDF，或可编辑的 Word 文档。