Management of Technical Vulnerabilities
Description
Information about technical vulnerabilities of information systems in use shall be obtained, the organisation's exposure to such vulnerabilities shall be evaluated, and appropriate measures shall be taken.
⚠️ Risk Impact
The dominant cause of preventable breaches: unpatched known vulnerabilities. CVEs disclosed publicly are exploited within days; organisations with slow patch cycles are systematically targeted.
🔍 How EchelonGraph Detects This
EchelonGraph's Tier 1 Cloud Scanner automatically checks for this condition across all connected cloud accounts. Violations are flagged as critical-severity findings with remediation guidance.
🔧 Remediation
Define SLA by severity: Critical 7d, High 30d, Medium 90d. Automate patching where possible. Document exceptions with risk-acceptance + compensating controls. Continuous CVE scanning across cloud, containers, deps.
💀 Real-World Attack Scenario
Equifax 2017: known Apache Struts vulnerability (CVE-2017-5638) disclosed March; Equifax's patch process took 60+ days to reach the vulnerable application. Between March-July, attackers exfiltrated 147M consumer records. Total: $1.4B remediation + $575M FTC settlement.
💰 Cost of Non-Compliance
Unpatched-vuln breach: avg $4.45M (IBM 2024). Equifax: $1.4B+. MOVEit 2023: $12B industry. PCI-6.2 violations: $5K-$100K/month.
📋 Audit Questions
- 1.Patch SLA by severity?
- 2.Current MTTR vs SLA?
- 3.Walk through a Critical CVE — detection to remediation?
- 4.Exception list maintained?
🎯 MITRE ATT&CK Mapping
⚡ Common Pitfalls
- ⛔SLAs documented but MTTR drifts unmeasured
- ⛔Exception list accumulates without renewal
- ⛔Patching infra but not application deps
📈 Business Value
Disciplined patching is the highest-ROI security investment.
⏱️ Effort Estimate
Ongoing per-CVE remediation
EchelonGraph correlates CVEs to live workloads; tracks SLA per finding
🔗 Cross-Framework References
Automate ISO 27001 A.8.8 compliance
EchelonGraph continuously monitors this control across all your cloud accounts.
Start Free →