FFIEC IT Examination Handbook AIO-VI.B.3(a): VI.B.3(a) Vulnerability Management (Architecture, Infrastructure, and Operations)

What does AIO-VI.B.3(a) require?

Management runs a vulnerability management program that identifies system and software vulnerabilities, prioritises them and the affected systems by risk and remediates them in time according to that risk, covering cloud systems it is responsible for and on-premises systems, monitors US-CERT, NIST, FS-ISAC and other reporting sources and addresses relevant exposures, periodically scans all systems and software in the hardware, software and telecommunications inventories with scanners carrying a current vulnerability list, controls the scanning tools through separation of duties, logical security, configuration management and log review, and uses a dedicated account for authenticated scans.