Creates the vulnerability management programme of the company from its assets, responsibilities and constraints: policy, procedure, roles, assessment schedule, prioritisation method, remediation SLA matrix, exception process, escalation and reporting. The other vulnerability services work from its rules.
Contents
1. Document Information
2. Purpose and Objectives
3. Scope and Applicability
4. Vulnerability Management Principles
5. Roles and Responsibilities
6. Vulnerability Identification Methods
7. Assessment Frequency
8. Vulnerability Classification Methodology
9. Risk Prioritization Criteria
10. Remediation SLAs
11. Remediation Workflow
12. Emergency Vulnerability Handling
13. Exception and Risk Acceptance
14. Remediation Verification
15. Reporting and Performance Monitoring
16. Escalation Process
17. Review and Continuous Improvement
18. Approval and Document History
What you provide
Deliverable — Its title, its author and its structure are yours: they steer what is written.
Company context — What the programme protects.
Scope — What is covered and what is not.
Approach — How vulnerabilities are found.
Risk and prioritisation — How the order of work is decided.
