Procedure
Vulnerability Management Procedure
To ensure that vulnerabilities in organizational systems, applications, cloud environments, and third-party components are identified, assessed, prioritized, and remediated within defined timeframes, reducing exposure to exploitation and maintaining a defensible security posture.
- Type
- Procedure
- Version
- 1.3.28
- Date
- 2026-10-27
- Owner
- Chief Information Security Officer
- Approving authority
- Governance Library Maintainer
- Classification
- Public
- Confidentiality
- Public
- Category
- Information Security
- Review frequency
- Annual and upon material threat, framework, or regulatory change
- Licence
- CC BY-SA 4.0
Read the full text on GitHub (opens in a new tab)
Outline
- Purpose
- Scope
- Governance and accountability
- 1. Vulnerability scanning
- 2. Severity classification and patch slas
- 3. Triage and prioritization
- 4. Remediation workflow
- 5. EOL and lifecycle management
- 6. Exception process
- 7. Cloud platform vulnerability management
- 8. Metrics
- Framework alignment
Frameworks it maps to
Related documents
- Information Security Policysecurity
- Production Security Requirementsoperations
- Cloud Security Configuration Baselineoperations
- Change Management and Configuration Control Procedureoperations
- Patch Management Procedureoperations
Next
All Documents