CISA Cyber Resilience Review (CRR) v4.0 VM.3: Exposure to identified vulnerabilities is managed

What does VM.3 require?

Exposure to each identified vulnerability is actively managed, mitigation effectiveness is reviewed, and open vulnerabilities are kept under watch until resolved.

Maintained by Gerard Blokdyk

Other controls in Vulnerability Management – CISA Cyber Resilience Review (CRR) v4.0

VM.1 Preparation for vulnerability analysis and resolution
VM.2 A process for identifying and analysing vulnerabilities is established and maintained
VM.4 The root causes of vulnerabilities are addressed

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All CISA Cyber Resilience Review (CRR) v4.0 controls