FFIEC IT Examination Handbook IS-II.A.2: II.A.2 Vulnerabilities (Information Security)

Management identifies technical vulnerabilities in hardware, firmware and software with automated scanners and tracking services such as CVE, weaknesses in business processes, procedures, administrative controls, physical layout and internal controls that could be exploited, and the vulnerabilities that arise from interdependent and interconnected systems, mergers and relationships with third parties.