VM-15—Third-Party Library Check

>Control Description

Organization scans third-party libraries for vulnerabilities according to the service risk rating assignment.

Theme

Technology

Type

Detective

Policy/Standard

Secure Development Lifecycle Policy

>Implementation Guidance

1. Ensure a process has been defined and documented for performing source code check for vulnerabilities. 2. Ensure that third-party libraries are scanned for vulnerabilities as per service risk rating assignment. 3. Ensure all vulnerabilities are tracked and resolved as per organization's SLA.

>Testing Procedure

1. Inspect and validate whether a process has been defined and documented for performing source code check for vulnerabilities. 2. Validate for a sample scan whether third-party libraries are scanned for vulnerabilities as per service risk rating assignment. 3. For a sample source code vulnerability validate that it was tracked and resolved per SLA.