RM-01—Service Risk Rating Assignment

>Control Description

Annually, Organization prioritizes the frequency of vulnerability discovery activities based on an assigned service risk rating.

Theme

Process

Type

Detective

Policy/Standard

Risk Management Standard

>Implementation Guidance

1. Ensure Risk management standard is in place and documented which defines the frequency of vulnerability discovery activities based on an assigned service risk rating. 2. Ensure all the identified vulnerabilities are remediated based on the risk rating.

>Testing Procedure

1. Validate that the organization has a defined vulnerability management standard. 2. For a sample of vulnerabilities, test that it was remediated based on risk ranking.