CI‐DR™ Key Capability Vulnerability Management Teams

Vulnerability management (VM) has multiple components that when working in concert becomes an instrument for connecting a cyber intelligence‐driven risk (CI‐DR) program. A VM program is intrinsically connected to both the primary and secondary objectives of a CI‐DR program. This chapter focuses on vulnerability management, patch management and vulnerability management that are intrinsically tied, and they are also mutually exclusive. To build an effective VM program in support of a CI‐DR, organizations need to focus on four key components. The four components within a VM program are vulnerability identification, vulnerability analysis, vulnerability management, and the vulnerability management team. With the knowledge and guidance of the aforementioned vulnerability frameworks, VM program teams have the groundwork to prioritize identified vulnerabilities. The prioritization of vulnerabilities is a process of determining the relevance, compensating controls, categorization, and responsibility.