API 1164 ID.RA-1: ID.RA-1 Vulnerability catalogue with consistent identification, categorisation and control effectiveness assessment

The plan must require a catalogue of identified vulnerabilities in all IAC segregated environments, with consistent criteria for identifying them and for assessing and categorising them (type, severity); inclusion of vulnerabilities published or disclosed by vendors, researchers and other sources; risk-appropriate internal assessment activities such as penetration tests, red and blue team exercises and internal audits; assessment of the design and operating effectiveness of both technical and procedural controls, with the design assessments covering physical compensating controls; recording of each vulnerability's identifier, assessment results and categorisation in the catalogue; identification of the disclosure and modification risk to the catalogue, which is classified and protected accordingly; consultation of the responsible stakeholders through management of change on modifications that could affect cybersecurity; and periodic repetition driven by risk criteria including the impact rating of the zones and conduits. At the Enhanced Profile design and operating effectiveness are reassessed at least every 3 years (never later than 45 months) and evaluated no more than 12 months after a segregated environment is introduced or significantly changed.