Some vulnerabilities cannot be remediated immediately, but unmanaged exceptions create persistent exposure.
Require documented business justification, risk assessment, owner, expiry date, compensating controls, and periodic review for deferred remediation.
| FRAMEWORK CODE | FRAMEWORK NAME & DETAILS | FAMILY / CATEGORY | VERSION | ACTION |
|---|---|---|---|---|
| IRDAI | IRDAI Information & Cyber Security Guidelines IRDAI information and cyber-security requirements... Clause: §2.6-3.6 – Vulnerability Management |
India
Guideline
|
vLatest | View → |
| RBI-CSF | RBI Cyber Security Framework / Master Directions RBI cyber-security requirements and directions set... Clause: 7) Patch/Vulnerability & Change Management – 7.1 Risk-based patch inventory, identification and application to minimise exposure; 18) Vulnerability assessment and Penetration Test and Red Team Exercises – 18.1 Periodic VA/PT of critical systems, especially internet-facing |
India
Regulation
|
vLatest | View → |
| SEBI-CSCRF | SEBI Cyber Security & Cyber Resilience Framework SEBI’s Cybersecurity and Cyber Resilience Framewor... Clause: 4.1 DE.CM: Security Continuous Monitoring; 2.2 ID.RA: Risk Assessment |
India
Regulation
|
vLatest | View → |
| DORA | Digital Operational Resilience Act The EU Digital Operational Resilience Act establis... Clause: Article 8(2) – Continuous identification of ICT risk sources, cyber threats and ICT vulnerabilities Article 8(3) – ICT risk assessment following major changes |
EU
Regulation
|
vCurrent | View → |
| HIPAA | Health Insurance Portability and Accountability Act HIPAA is a U.S. federal law supported by implement... Clause: § 164.312(h) Standard: Vulnerability management |
US
Law
|
vCurrent | View → |
| NIS2 | NIS2 Directive The NIS2 Directive establishes EU-wide cybersecuri... Clause: Article 21(2)(e) – Security in network and information systems acquisition, development and maintenance, including vulnerability handling and disclosure |
EU
Directive
|
vCurrent | View → |
| NIST-CSF | NIST Cybersecurity Framework (CSF) The NIST Cybersecurity Framework provides high-lev... Clause: ID.RA – Risk Assessment | ID.RA-01 – Vulnerabilities in assets are identified, validated, and recorded ID.RA – Risk Assessment | ID.RA-06 – Risk responses are chosen, prioritized, planned, tracked, and communicated ID.IM – Improvement | ID.IM-03 – Improvements are identified from execution of operational processes, procedures, and activities |
NIST
Framework
|
v2 | View → |
| NIST80053 | NIST SP 800-53 NIST SP 800-53 Rev. 5 presents control families, i... Clause: 3.16 – RISK ASSESSMENT; RA-5 – VULNERABILITY MONITORING AND SCANNING |
NIST
Control Catalog
|
vRev. 5 | View → |
| NPCI-ISR | NPCI Information Security Requirements NPCI information-security requirements define cont... Clause: Operational Review; VAPT Testing and Re-assessment |
India
Standard
|
vLatest | View → |
| SOC2 | SOC 2 Trust Services Criteria SOC 2 is an independent examination and reporting... Clause: CC7.1 – System Operations – To meet its objectives, the entity uses detection and monitoring procedures to identify (1) changes to configurations that result in the introduction of new vulnerabilities, and (2) susceptibilities to newly discovered vulnerabilities. CC3.2 – Risk Assessment – COSO Principle 7: The entity identifies risks to the achievement of its objectives across the entity and analyzes risks as a basis for determining how the risks should be managed. |
AICPA
Audit Framework
|
vLatest | View → |