Vulnerability Management

Overview

Vulnerability Management is the continuous governance and operational process for discovering, validating, assessing, prioritizing, remediating, mitigating, accepting, and verifying weaknesses across technology assets. It is broader than patch management because vulnerabilities may require configuration changes, code fixes, compensating controls, retirement, or risk acceptance. It should be interpreted alongside Vulnerability Prioritization, which may affect the same workflow without representing the same control, event, or risk.

Incomplete inventories, scanner gaps, false positives, unowned assets, delayed remediation, unsafe patches, and weak exception handling can leave exploitable exposure.

Organizations should maintain asset and software inventories, combine multiple discovery methods, enrich with threat evidence, assign owners, set risk-based deadlines, test changes, and track exceptions.

Retain asset and vulnerability identifiers, discovery source, affected version, exploit evidence, business context, priority, owner, deadline, remediation, validation, and acceptance approval.

Assessment of Vulnerability Management should trace the continuous governance and operational process for discovering, validating, assessing, prioritizing, remediating, mitigating, accepting, and verifying weaknesses across technology assets from prerequisite and entry point through observable impact on the affected service. A theoretical weakness or scanner result involving validating, assessing, and prioritizing should not be reported as exploitation without corroborating logs, transactions, or configuration evidence. Prevention, detection, containment, and recovery for the Vulnerability lifecycle should be tested against the architecture associated with validating, assessing, and prioritizing.

Retesting for Vulnerability Management should reproduce the Vulnerability lifecycle involving validating, assessing, and prioritizing, examine adjacent paths, and verify the conditions for safely returning the affected service to normal operation.

The next review of Vulnerability Management should record remaining uncertainty concerning validating, assessing, and prioritizing, the accountable owner, the required action, and the date on which closure will be verified.