Establishes the processes for identifying, assessing, prioritizing, and remediating vulnerabilities across organizational systems and applications.
Focuses on the technical process of identifying, assessing, prioritizing, and remediating vulnerabilities across the entire technology estate.
The number of vulnerabilities is overwhelming, and organizations struggle to prioritize remediation efforts based on actual business risk rather than just severity scores.
| Control ID | Control Name | Category & Type | Criticality | Status | Requirements | Action |
|---|---|---|---|---|---|---|
| VUL-001 | Vulnerability Management Strategy Establishes enterprise vulnerability man... |
Administrative
Detective
|
Critical | Active | 📋 10 Reqs | View → |
| VUL-002 | Vulnerability Assessment & Scanning Establishes vulnerability assessment inc... |
Technical
Detective
|
Critical | Active | 📋 10 Reqs | View → |
| VUL-003 | Vulnerability Prioritization Establishes vulnerability prioritization... |
Technical
Preventive
|
High | Active | 📋 10 Reqs | View → |
| VUL-004 | Vulnerability Intelligence Establishes vulnerability intelligence i... |
Technical
Detective
|
High | Active | 📋 10 Reqs | View → |
| VUL-005 | Patch Management Establishes patch management including i... |
Technical
Corrective
|
Critical | Active | 📋 10 Reqs | View → |
| VUL-006 | Vulnerability Reporting & SLA Management Establishes vulnerability reporting and... |
Administrative
Detective
|
High | Active | 📋 10 Reqs | View → |
| VUL-007 | Vulnerability Exception Management Establishes vulnerability exception mana... |
Administrative
Corrective
|
High | Active | 📋 10 Reqs | View → |
| VUL-008 | Exposure Analytics Establishes exposure analytics including... |
Technical
Detective
|
High | Active | 📋 10 Reqs | View → |
The following requirements dictate specific audit evidence criteria and testing steps mapped directly under the controls of this domain.
| REQUIREMENT ID | REQUIREMENT TITLE & DETAILS | MAPPED CONTROL | TYPICAL OWNER | ACTION |
|---|---|---|---|---|
| VUL-001-R001 | Vulnerability Management Framework The organization shall establish a vulne... | VUL-001 Vulnerability Management Strat... | CISO / Vulnerability Management Team | View ↗ |
| VUL-001-R002 | Vulnerability Governance The organization shall establish governa... | VUL-001 Vulnerability Management Strat... | CISO / Vulnerability Management Team | View ↗ |
| VUL-001-R003 | Risk-Based Methodology The organization shall establish a risk-... | VUL-001 Vulnerability Management Strat... | CISO / Vulnerability Management Team | View ↗ |
| VUL-001-R004 | Roles & Responsibilities The organization shall clearly define an... | VUL-001 Vulnerability Management Strat... | CISO / Vulnerability Management Team | View ↗ |
| VUL-001-R005 | Vulnerability Scope The organization shall define a document... | VUL-001 Vulnerability Management Strat... | CISO / Vulnerability Management Team | View ↗ |
| VUL-001-R006 | Program Monitoring The organization shall monitor vulnerabi... | VUL-001 Vulnerability Management Strat... | CISO / Vulnerability Management Team | View ↗ |
| VUL-001-R007 | Program Reporting The organization shall report on vulnera... | VUL-001 Vulnerability Management Strat... | CISO / Vulnerability Management Team | View ↗ |
| VUL-001-R008 | Program Review The organization shall conduct periodic... | VUL-001 Vulnerability Management Strat... | CISO / Vulnerability Management Team | View ↗ |
| VUL-001-R009 | Exception Governance The organization shall establish governa... | VUL-001 Vulnerability Management Strat... | CISO / Vulnerability Management Team | View ↗ |
| VUL-001-R010 | Program Continuous Improvement The organization shall drive ongoing enh... | VUL-001 Vulnerability Management Strat... | CISO / Vulnerability Management Team | View ↗ |
| VUL-002-R001 | Assessment Framework The organization shall establish a vulne... | VUL-002 Vulnerability Assessment & Sca... | Vulnerability Management / Security Engineering | View ↗ |
| VUL-002-R002 | Scan Planning The organization shall conduct formal pl... | VUL-002 Vulnerability Assessment & Sca... | Vulnerability Management / Security Engineering | View ↗ |
| VUL-002-R003 | Scan Execution The organization shall execute vulnerabi... | VUL-002 Vulnerability Assessment & Sca... | Vulnerability Management / Security Engineering | View ↗ |
| VUL-002-R004 | Vulnerability Identification The organization shall use vulnerability... | VUL-002 Vulnerability Assessment & Sca... | Vulnerability Management / Security Engineering | View ↗ |
| VUL-002-R005 | Risk Prioritization The organization shall prioritize identi... | VUL-002 Vulnerability Assessment & Sca... | Vulnerability Management / Security Engineering | View ↗ |
| VUL-002-R006 | Scan Validation The organization shall validate vulnerab... | VUL-002 Vulnerability Assessment & Sca... | Vulnerability Management / Security Engineering | View ↗ |
| VUL-002-R007 | Scan Monitoring The organization shall monitor vulnerabi... | VUL-002 Vulnerability Assessment & Sca... | Vulnerability Management / Security Engineering | View ↗ |
| VUL-002-R008 | Assessment Reporting The organization shall report on vulnera... | VUL-002 Vulnerability Assessment & Sca... | Vulnerability Management / Security Engineering | View ↗ |
| VUL-002-R009 | Assessment Review The organization shall conduct periodic... | VUL-002 Vulnerability Assessment & Sca... | Vulnerability Management / Security Engineering | View ↗ |
| VUL-002-R010 | Assessment Continuous Improvement The organization shall drive ongoing enh... | VUL-002 Vulnerability Assessment & Sca... | Vulnerability Management / Security Engineering | View ↗ |
| VUL-003-R001 | VUL-003 Remediation Framework | VUL-003 Vulnerability Prioritization | A security analyst validates a critical server vulnerability against the installed software version before opening a high-priority remediation ticket. | View ↗ |
| VUL-003-R002 | VUL-003 Vulnerability Triage | VUL-003 Vulnerability Prioritization | A security analyst validates a critical server vulnerability against the installed software version before opening a high-priority remediation ticket. | View ↗ |
| VUL-003-R003 | VUL-003 Remediation Planning | VUL-003 Vulnerability Prioritization | A security analyst validates a critical server vulnerability against the installed software version before opening a high-priority remediation ticket. | View ↗ |
| VUL-003-R004 | VUL-003 Remediation Implementation | VUL-003 Vulnerability Prioritization | A security analyst validates a critical server vulnerability against the installed software version before opening a high-priority remediation ticket. | View ↗ |
| VUL-003-R005 | VUL-003 Remediation Tracking | VUL-003 Vulnerability Prioritization | A security analyst validates a critical server vulnerability against the installed software version before opening a high-priority remediation ticket. | View ↗ |
| VUL-003-R006 | VUL-003 Verification Testing | VUL-003 Vulnerability Prioritization | A security analyst validates a critical server vulnerability against the installed software version before opening a high-priority remediation ticket. | View ↗ |
| VUL-003-R007 | VUL-003 Exception Governance | VUL-003 Vulnerability Prioritization | A security analyst validates a critical server vulnerability against the installed software version before opening a high-priority remediation ticket. | View ↗ |
| VUL-003-R008 | VUL-003 Remediation Reporting | VUL-003 Vulnerability Prioritization | A security analyst validates a critical server vulnerability against the installed software version before opening a high-priority remediation ticket. | View ↗ |
| VUL-003-R009 | VUL-003 Remediation Review | VUL-003 Vulnerability Prioritization | A security analyst validates a critical server vulnerability against the installed software version before opening a high-priority remediation ticket. | View ↗ |
| VUL-003-R010 | VUL-003 Remediation Continuous Improvement | VUL-003 Vulnerability Prioritization | A security analyst validates a critical server vulnerability against the installed software version before opening a high-priority remediation ticket. | View ↗ |
| VUL-004-R001 | VUL-004 Patch Management Framework | VUL-004 Vulnerability Intelligence | A critical internet-facing payment system vulnerability is prioritized ahead of a higher-scoring issue on an isolated test server. | View ↗ |
| VUL-004-R002 | VUL-004 Patch Identification | VUL-004 Vulnerability Intelligence | A critical internet-facing payment system vulnerability is prioritized ahead of a higher-scoring issue on an isolated test server. | View ↗ |
| VUL-004-R003 | VUL-004 Patch Assessment | VUL-004 Vulnerability Intelligence | A critical internet-facing payment system vulnerability is prioritized ahead of a higher-scoring issue on an isolated test server. | View ↗ |
| VUL-004-R004 | VUL-004 Patch Prioritization | VUL-004 Vulnerability Intelligence | A critical internet-facing payment system vulnerability is prioritized ahead of a higher-scoring issue on an isolated test server. | View ↗ |
| VUL-004-R005 | VUL-004 Patch Testing | VUL-004 Vulnerability Intelligence | A critical internet-facing payment system vulnerability is prioritized ahead of a higher-scoring issue on an isolated test server. | View ↗ |
| VUL-004-R006 | VUL-004 Patch Deployment | VUL-004 Vulnerability Intelligence | A critical internet-facing payment system vulnerability is prioritized ahead of a higher-scoring issue on an isolated test server. | View ↗ |
| VUL-004-R007 | VUL-004 Patch Compliance Monitoring | VUL-004 Vulnerability Intelligence | A critical internet-facing payment system vulnerability is prioritized ahead of a higher-scoring issue on an isolated test server. | View ↗ |
| VUL-004-R008 | VUL-004 Patch Reporting | VUL-004 Vulnerability Intelligence | A critical internet-facing payment system vulnerability is prioritized ahead of a higher-scoring issue on an isolated test server. | View ↗ |
| VUL-004-R009 | VUL-004 Patch Review | VUL-004 Vulnerability Intelligence | A critical internet-facing payment system vulnerability is prioritized ahead of a higher-scoring issue on an isolated test server. | View ↗ |
| VUL-004-R010 | VUL-004 Patch Continuous Improvement | VUL-004 Vulnerability Intelligence | A critical internet-facing payment system vulnerability is prioritized ahead of a higher-scoring issue on an isolated test server. | View ↗ |
| VUL-005-R001 | VUL-005 Vulnerability Reporting Framework | VUL-005 Patch Management | High-risk operating system vulnerabilities are patched through a controlled change process and verified by a follow-up scan. | View ↗ |
| VUL-005-R002 | VUL-005 Reporting Content | VUL-005 Patch Management | High-risk operating system vulnerabilities are patched through a controlled change process and verified by a follow-up scan. | View ↗ |
| VUL-005-R003 | VUL-005 Reporting Frequency | VUL-005 Patch Management | High-risk operating system vulnerabilities are patched through a controlled change process and verified by a follow-up scan. | View ↗ |
| VUL-005-R004 | VUL-005 Management Reporting | VUL-005 Patch Management | High-risk operating system vulnerabilities are patched through a controlled change process and verified by a follow-up scan. | View ↗ |
| VUL-005-R005 | VUL-005 Executive Reporting | VUL-005 Patch Management | High-risk operating system vulnerabilities are patched through a controlled change process and verified by a follow-up scan. | View ↗ |
| VUL-005-R006 | VUL-005 Vulnerability Metrics | VUL-005 Patch Management | High-risk operating system vulnerabilities are patched through a controlled change process and verified by a follow-up scan. | View ↗ |
| VUL-005-R007 | VUL-005 Report Validation | VUL-005 Patch Management | High-risk operating system vulnerabilities are patched through a controlled change process and verified by a follow-up scan. | View ↗ |
| VUL-005-R008 | VUL-005 Reporting Review | VUL-005 Patch Management | High-risk operating system vulnerabilities are patched through a controlled change process and verified by a follow-up scan. | View ↗ |
| VUL-005-R009 | VUL-005 Reporting Improvement | VUL-005 Patch Management | High-risk operating system vulnerabilities are patched through a controlled change process and verified by a follow-up scan. | View ↗ |
| VUL-005-R010 | VUL-005 Risk Communication | VUL-005 Patch Management | High-risk operating system vulnerabilities are patched through a controlled change process and verified by a follow-up scan. | View ↗ |
| VUL-006-R001 | Reporting Framework The organization shall establish a vulne... | VUL-006 Vulnerability Reporting & SLA... | Vulnerability Management / CISO | View ↗ |
| VUL-006-R002 | Remediation SLA Definition The organization shall define remediatio... | VUL-006 Vulnerability Reporting & SLA... | Vulnerability Management / CISO | View ↗ |
| VUL-006-R003 | SLA Monitoring The organization shall monitor remediati... | VUL-006 Vulnerability Reporting & SLA... | Vulnerability Management / CISO | View ↗ |
| VUL-006-R004 | Vulnerability Metrics The organization shall define and track... | VUL-006 Vulnerability Reporting & SLA... | Vulnerability Management / CISO | View ↗ |
| VUL-006-R005 | Executive Reporting The organization shall provide executive... | VUL-006 Vulnerability Reporting & SLA... | Vulnerability Management / CISO | View ↗ |
| VUL-006-R006 | Operational Reporting The organization shall provide operation... | VUL-006 Vulnerability Reporting & SLA... | Vulnerability Management / CISO | View ↗ |
| VUL-006-R007 | KPI & Trend Analysis The organization shall conduct KPI and t... | VUL-006 Vulnerability Reporting & SLA... | Vulnerability Management / CISO | View ↗ |
| VUL-006-R008 | Reporting Review The organization shall conduct periodic... | VUL-006 Vulnerability Reporting & SLA... | Vulnerability Management / CISO | View ↗ |
| VUL-006-R009 | Escalation Management The organization shall establish escalat... | VUL-006 Vulnerability Reporting & SLA... | Vulnerability Management / CISO | View ↗ |
| VUL-006-R010 | Reporting Continuous Improvement The organization shall establish a conti... | VUL-006 Vulnerability Reporting & SLA... | Vulnerability Management / CISO | View ↗ |
| VUL-007-R001 | Exception Management Framework The organization shall establish a vulne... | VUL-007 Vulnerability Exception Manage... | Vulnerability Management / Threat Intelligence | View ↗ |
| VUL-007-R002 | Exception Request The organization shall submit exception... | VUL-007 Vulnerability Exception Manage... | Vulnerability Management / Threat Intelligence | View ↗ |
| VUL-007-R003 | Risk Assessment The organization shall conduct risk asse... | VUL-007 Vulnerability Exception Manage... | Vulnerability Management / Threat Intelligence | View ↗ |
| VUL-007-R004 | Exception Approval The organization shall approve vulnerabi... | VUL-007 Vulnerability Exception Manage... | Vulnerability Management / Threat Intelligence | View ↗ |
| VUL-007-R005 | Compensating Controls The organization shall require implement... | VUL-007 Vulnerability Exception Manage... | Vulnerability Management / Threat Intelligence | View ↗ |
| VUL-007-R006 | Exception Monitoring The organization shall monitor approved... | VUL-007 Vulnerability Exception Manage... | Vulnerability Management / Threat Intelligence | View ↗ |
| VUL-007-R007 | Exception Renewal The organization shall renew vulnerabili... | VUL-007 Vulnerability Exception Manage... | Vulnerability Management / Threat Intelligence | View ↗ |
| VUL-007-R008 | Exception Reporting The organization shall report on vulnera... | VUL-007 Vulnerability Exception Manage... | Vulnerability Management / Threat Intelligence | View ↗ |
| VUL-007-R009 | Exception Review The organization shall conduct periodic... | VUL-007 Vulnerability Exception Manage... | Vulnerability Management / Threat Intelligence | View ↗ |
| VUL-007-R010 | Exception Closure The organization shall close vulnerabili... | VUL-007 Vulnerability Exception Manage... | Vulnerability Management / Threat Intelligence | View ↗ |
| VUL-008-R001 | Exposure Analytics Framework The organization shall establish an expo... | VUL-008 Exposure Analytics | Risk & Compliance / System Owner | View ↗ |
| VUL-008-R002 | Exposure Data Collection The organization shall collect exposure... | VUL-008 Exposure Analytics | Risk & Compliance / System Owner | View ↗ |
| VUL-008-R003 | Risk Trend Analysis The organization shall conduct risk tren... | VUL-008 Exposure Analytics | Risk & Compliance / System Owner | View ↗ |
| VUL-008-R004 | Attack Surface Analysis The organization shall conduct attack su... | VUL-008 Exposure Analytics | Risk & Compliance / System Owner | View ↗ |
| VUL-008-R005 | Exposure Scoring The organization shall apply exposure sc... | VUL-008 Exposure Analytics | Risk & Compliance / System Owner | View ↗ |
| VUL-008-R006 | Executive Dashboards The organization shall develop and maint... | VUL-008 Exposure Analytics | Risk & Compliance / System Owner | View ↗ |
| VUL-008-R007 | Analytics Reporting The organization shall report on exposur... | VUL-008 Exposure Analytics | Risk & Compliance / System Owner | View ↗ |
| VUL-008-R008 | Analytics Review The organization shall conduct periodic... | VUL-008 Exposure Analytics | Risk & Compliance / System Owner | View ↗ |
| VUL-008-R009 | Predictive Analysis The organization shall establish predict... | VUL-008 Exposure Analytics | Risk & Compliance / System Owner | View ↗ |
| VUL-008-R010 | Analytics Continuous Improvement The organization shall establish a conti... | VUL-008 Exposure Analytics | Risk & Compliance / System Owner | View ↗ |
| Framework Code | Framework Name & Description | Family / Category | Version | Action |
|---|---|---|---|---|
| NIST-CSF | NIST CSF (ID.RA-1) The NIST Cybersecurity Framework provide... |
NIST
Framework
|
v2 | View → |
| MAPPED | ISO 27001 (Clause A.12.6) Crosswalk regulatory baseline mapped under ASPIA UCL. | Standard | Baseline | — |
| MAPPED | CVSS Crosswalk regulatory baseline mapped under ASPIA UCL. | Standard | Baseline | — |
| MAPPED | CISA KEV Crosswalk regulatory baseline mapped under ASPIA UCL. | Standard | Baseline | — |
| PCI-DSS | PCI DSS PCI DSS is an industry security standard... |
PCI
Standard
|
v4 | View → |
| MAPPED | NIST SP 800-40 Crosswalk regulatory baseline mapped under ASPIA UCL. | Standard | Baseline | — |
| MAPPED | CWE Crosswalk regulatory baseline mapped under ASPIA UCL. | Standard | Baseline | — |
| MAPPED | OWASP Crosswalk regulatory baseline mapped under ASPIA UCL. | Standard | Baseline | — |