VM-23—Backlog Prioritization

>Control Description

Organization documents identified bugs, prioritize bug fixes according to risk, and tracks resolution as part of the product release cycle.

Theme

Process

Type

Corrective

Policy/Standard

Vulnerability Management Policy

>Implementation Guidance

1. Ensure a process has been defined and documented for creating documentation for identified bugs. 2. Ensure all identified bugs are fixed according to risk and are tracked till resolution

>Testing Procedure

1. Inspect and validate that a process has been defined and documented for creating documentation for identified bugs. 2. Validate for a sample of all identified bugs whether they were fixed according to risk and were tracked till resolution