SekitCrosswalk
ENES
Empieza ahora
Sekit CSF · Familia

Vulnerability & Configuration

21 controles en 7 temas, cada uno visto a través de las lentes de política, proceso y técnica.

Política

RCF-0226Baseline compliance7 mapeosThe company formally measures compliance of all systems against approved security configuration baselinesRCF-0223Configuration management6 mapeosSecurity configuration standards are formally defined and required for all system typesRCF-0232Exposure management6 mapeosThe company formally identifies and manages its external attack surface to reduce the risk of exploitationRCF-0229Patch prioritization6 mapeosThe company formally prioritises patches based on vulnerability severity, asset criticality and exploitation likelihoodRCF-0235Penetration testing4 mapeosThe company formally commissions periodic penetration tests to identify exploitable weaknessesRCF-0220Vulnerability remediation SLAs6 mapeosThe company formally defines how quickly vulnerabilities must be remediated based on their severityRCF-0217Vulnerability scanning4 mapeosThe company formally requires regular scanning of all systems to identify known security vulnerabilities

Proceso

RCF-0227Baseline compliance7 mapeosBaseline compliance is consistently monitored and non-compliant systems are remediated within agreed timelinesRCF-0224Configuration management6 mapeosSystem configurations are consistently reviewed against approved standards and deviations are correctedRCF-0233Exposure management7 mapeosExternal-facing assets are consistently inventoried and exposure is reduced where it is not business-justifiedRCF-0230Patch prioritization6 mapeosPatch prioritisation decisions are consistently applied and documented when deviating from the standard scheduleRCF-0236Penetration testing4 mapeosPenetration tests are consistently scoped, conducted and findings are tracked to remediationRCF-0221Vulnerability remediation SLAs6 mapeosVulnerability remediation deadlines are consistently tracked and escalated when at risk of being missedRCF-0218Vulnerability scanning4 mapeosVulnerability scans are consistently run on schedule and results are reviewed and acted upon

Técnica

RCF-0228Baseline compliance4 mapeosTechnical tools report baseline compliance rates across the infrastructure and track remediation progressRCF-0225Configuration management3 mapeosTechnical tools continuously assess system configurations and automatically remediate or alert on deviationsRCF-0234Exposure management5 mapeosTechnical tools continuously monitor the external attack surface and alert on newly exposed or vulnerable assetsRCF-0231Patch prioritization5 mapeosTechnical tools integrate vulnerability severity and threat intelligence to automate patch prioritisationRCF-0237Penetration testing4 mapeosTechnical infrastructure supports controlled penetration testing without affecting production availabilityRCF-0222Vulnerability remediation SLAs4 mapeosTechnical tools track vulnerability age against defined SLAs and automatically escalate overdue itemsRCF-0219Vulnerability scanning3 mapeosTechnical tools conduct automated vulnerability scans and feed results into the remediation tracking process

Esta familia en ISO/IEC 27001:2022

Cada elemento de marco al que mapean los controles de la familia, primero los más conectados; agrupado por familia del Sekit CSF, nunca por el índice del propio marco.

A.8.8 Management of technical vulnerabilitiesA.5.1 Policies for information securityA.8.9 Configuration managementA.5.37 Documented operating proceduresA.5.36 Compliance with policies, rules and standards for information securityA.8.34 Protection of information systems during audit testingA.8.16 Monitoring activitiesA.5.9 Inventory of information and other associated assetsA.5.7 Threat intelligenceA.8.31 Separation of development, test and production environments

Esta familia en NIST CSF 2.0

ID.RA-05 Inherent risk understoodPR.PS-02 Software maintainedID.RA-01 Vulnerabilities identified and recordedID.RA-07 Changes and exceptions managedPR.PS-01 Configuration management appliedID.IM-02 Improvements from tests and exercisesID.RA-06 Risk responses chosen and tracked

Esta familia en Cyber Essentials

CE2.1 Remove unnecessary accounts and softwareCE3.2 Apply critical updates within 14 daysCE2.2 Change default and guessable passwordsCE1.3 Block unauthenticated inbound trafficCE1.2 Protect the administrative interface
Pregúntale a Sekura: «¿Qué evidencia demuestra Vulnerability & Configuration?»
También vía MCP, gratis con cuenta