Draft v0.1.06 of 6 frameworks
Vulnerability scanning and patching
Vulnerabilities are regularly identified through scanning, risk-ranked and remediated within defined timelines.
Where it appears
- SOC 2
CC7.1Detection and monitoring procedures identify vulnerabilities- PCI DSS 4.0
6.3Security vulnerabilities are identified and addressed11.3External and internal vulnerabilities are regularly identified, prioritized and addressed- NIST CSF 2.0
ID.RARisk assessment (vulnerability identification, ID.RA-01)PR.PS-02Software is maintained, replaced and removed commensurate with risk- ISO 27001:2022
A.8.8Management of technical vulnerabilities- HIPAA Security Rule
164.308(a)(8)Evaluation (periodic technical evaluation)- NIST 800-53 r5
RA-5Vulnerability monitoring and scanningSI-2Flaw remediation
Evidence auditors usually ask for
A typical starting list. Your assessor's request list is the one that counts.
- Vulnerability management policy with remediation SLAs by severity
- Internal and external scan reports across the audit period (PCI: quarterly ASV scans)
- Evidence of remediation or risk acceptance for findings
- Patch compliance reports for servers, endpoints and network devices
Crosswalks that include this
SOC 2 to PCI DSS 4.0SOC 2 to NIST CSF 2.0SOC 2 to ISO 27001:2022SOC 2 to HIPAA Security RuleSOC 2 to NIST 800-53 r5PCI DSS 4.0 to SOC 2PCI DSS 4.0 to NIST CSF 2.0PCI DSS 4.0 to ISO 27001:2022PCI DSS 4.0 to HIPAA Security RulePCI DSS 4.0 to NIST 800-53 r5NIST CSF 2.0 to SOC 2NIST CSF 2.0 to PCI DSS 4.0