A governed vulnerability program establishes scope, accountability, risk criteria, and remediation expectations across the technology estate.
Define program scope, roles, risk methodology, remediation SLAs, reporting requirements, and escalation paths. Align the program with asset, risk, incident, and configuration management.
| FRAMEWORK CODE | FRAMEWORK NAME & DETAILS | FAMILY / CATEGORY | VERSION | ACTION |
|---|---|---|---|---|
| IRDAI | IRDAI Information & Cyber Security Guidelines IRDAI information and cyber-security requirements... Clause: §2.6-3.6 – Vulnerability Management |
India
Guideline
|
vLatest | View → |
| RBI-CSF | RBI Cyber Security Framework / Master Directions RBI cyber-security requirements and directions set... Clause: 7) Patch/Vulnerability & Change Management – 7.1 Risk-based patch inventory, identification and application to minimise exposure; 18) Vulnerability assessment and Penetration Test and Red Team Exercises – 18.1 Periodic VA/PT of critical systems, especially internet-facing |
India
Regulation
|
vLatest | View → |
| SEBI-CSCRF | SEBI Cyber Security & Cyber Resilience Framework SEBI’s Cybersecurity and Cyber Resilience Framewor... Clause: 4.1 DE.CM: Security Continuous Monitoring; 2.2 ID.RA: Risk Assessment |
India
Regulation
|
vLatest | View → |
| DORA | Digital Operational Resilience Act The EU Digital Operational Resilience Act establis... Clause: Article 8(2) – Continuous identification of ICT risk sources, cyber threats and ICT vulnerabilities Article 9(1) – Continuous monitoring/control of ICT security and functioning Article 9(4)(f) – Documented policies for patches and updates |
EU
Regulation
|
vCurrent | View → |
| ISO27002 | ISO/IEC 27002 ISO/IEC 27002 is a guidance standard containing a... Clause: 8.8 – Management of technical vulnerabilities |
ISO
Standard
|
v2022 | View → |
| NIS2 | NIS2 Directive The NIS2 Directive establishes EU-wide cybersecuri... Clause: Article 21(2)(e) – Security in network and information systems acquisition, development and maintenance, including vulnerability handling and disclosure |
EU
Directive
|
vCurrent | View → |
| COBIT2019 | COBIT COBIT is an enterprise governance and management f... Clause: 4.5 – Monitor, Evaluate and Assess (MEA) > MEA02 – Managed System of Internal Control > MEA02.04 – Identify and report control deficiencies. |
COBIT
Governance Framework
|
v2019 | View → |
| NIST-CSF | NIST Cybersecurity Framework (CSF) The NIST Cybersecurity Framework provides high-lev... Clause: ID.RA – Risk Assessment | ID.RA-07 – Changes and exceptions are managed, assessed for risk impact, recorded, and tracked |
NIST
Framework
|
v2 | View → |
| NIST80053 | NIST SP 800-53 NIST SP 800-53 Rev. 5 presents control families, i... Clause: 3.16 – RISK ASSESSMENT, 3.4 – ASSESSMENT, AUTHORIZATION, AND MONITORING; RA-7 – RISK RESPONSE, CA-6 – AUTHORIZATION |
NIST
Control Catalog
|
vRev. 5 | View → |
| CIS-V8 | CIS Controls CIS Controls are a prioritized set of cybersecurit... Clause: Control 07 – Continuous Vulnerability Management: 7.1 – Establish and Maintain a Vulnerability Management Process |
CIS
Best Practice
|
vv8 | View → |
| NPCI-ISR | NPCI Information Security Requirements NPCI information-security requirements define cont... Clause: Operational Review; VAPT Testing and Re-assessment |
India
Standard
|
vLatest | View → |
| SOC2 | SOC 2 Trust Services Criteria SOC 2 is an independent examination and reporting... Clause: CC7.1 – System Operations – To meet its objectives, the entity uses detection and monitoring procedures to identify (1) changes to configurations that result in the introduction of new vulnerabilities, and (2) susceptibilities to newly discovered vulnerabilities. CC3.2 – Risk Assessment – COSO Principle 7: The entity identifies risks to the achievement of its objectives across the entity and analyzes risks as a basis for determining how the risks should be managed. |
AICPA
Audit Framework
|
vLatest | View → |