Set and review procedures for vulnerability management covering the sources of vulnerability information (including public bodies, information-sharing organisations and third parties) and how it is obtained, assessment of severity, impact and scope, decisions on remediation method and deadline and tracking, and the decision process for exceptions; decide on each vulnerability under the procedures; set patching deadlines by system importance, risk and severity and track results (for high-risk configurations, such as business networks not separated from internet-facing networks, patch promptly or within a set period after an impact check), with management approval of the decision and the risk when a patch is exceptionally not applied; for severe vulnerabilities, identify affected systems from the registers and act promptly, include systems of group companies and overseas offices, and manage remediation at critical third parties (including shared systems), for example using SOC 2 or other assurance reports and contracts.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.