Skip to content

Vulnerability & Dependency Management

Vulnerability Detection

Summary

Every dependency, image, and runtime is assessed before deployment and at least weekly afterward, with affected services identifiable from a current component inventory.

Standards

  1. Every dependency, including a transitive dependency, container image, and runtime MUST be automatically assessed for known vulnerabilities before deployment. std-sec-vulnerability-detection-01
  2. The components of a deployed service MUST be automatically reassessed at least weekly and when relevant vulnerability information is received. std-sec-vulnerability-detection-02
  3. Where a new dependency vulnerability is disclosed, affected services MUST be identifiable from a current component inventory, such as a software bill of materials (SBOM). std-sec-vulnerability-detection-03

Implements These Principles

Vulnerability Remediation

Summary

A vulnerability's severity, exploitability, exposure, and impact determine its remediation priority; automated remediation is preferred, and the fix is verified before closure.

Standards

  1. A vulnerability MUST be prioritised using its severity, exploitability, exposure, and potential impact, and remediated within the maximum timeframe for its resulting risk rating: std-sec-vulnerability-remediation-01

    Risk Rating Maximum Remediation Timeframe
    Critical 14 days
    High 30 days
    Medium 90 days
    Low Next routine dependency update

  2. Remediation of a vulnerability MUST be verified, such as by re-scanning the affected dependency, container image, or runtime, before it is considered resolved. std-sec-vulnerability-remediation-02

  3. Vulnerability remediation SHOULD use automated tooling, such as automated security pull requests. std-sec-vulnerability-remediation-03

Implements These Principles

Exceptions

Summary

A vulnerability that cannot meet its remediation timeframe has a documented, time-bound exception and returns to active remediation when that exception expires.

Standards

  1. A vulnerability that cannot be remediated within its applicable risk-based remediation timeframe MUST have a documented, time-bound exception recording its justification, affected assets, compensating controls, and expiration date. std-sec-exceptions-01
  2. A vulnerability exception MUST expire automatically so the vulnerability returns to active remediation when the exception period lapses. std-sec-exceptions-02

Implements These Principles