Essential Cybersecurity Controls (ECC – 2 : 2024) - 2-10-1
Cybersecurity requirements for technical vulnerabilities management must be defined, documented and approved
Essential Cybersecurity Controls (ECC – 2 : 2024) - 2-10-2
The cybersecurity requirements for technical vulnerabilities management must be implemented.
Essential Cybersecurity Controls (ECC – 2 : 2024) - 2-10-3
- The cybersecurity requirements for technical vulnerabilities management must include at least the following:
- Periodic vulnerabilities assessments.
- Vulnerabilities classification based on criticality level.
- Vulnerabilities remediation based on classification and associated risk levels.
- Security patch management.
- Subscription with authorized and trusted cybersecurity resources for up-to-date information and notifications on technical vulnerabilities.
Essential Cybersecurity Controls (ECC – 2 : 2024) - 2-10-4
The cybersecurity requirements for technical vulnerabilities management must be reviewed periodically.