SFS 8 / SF D

Back to SFS 8

Status: Question model review passed; solution and completed SF authoring pending.

This is a generated authoring draft. Human approval and operational assessment results have not been supplied.

Question

Has the organization implemented a documented process to continuously monitor and address newly disclosed security vulnerabilities in third-party and open-source components used in production systems throughout the review period?

Plain-language explanation

Model-reviewed question draft. Completed explanations and a canonical solution are pending. The proposed positive criterion is: Documented evidence of vulnerability monitoring process with records of vulnerability identification and remediation actions

Assessment criterion and evidence

Actor: Organization. Scope: Production systems using third-party/open-source components. Evidence period: Review period. Required evidence: Vulnerability monitoring policy; Records of vulnerability identification; Remediation evidence. Negative criterion: No documented process or failure to address known critical vulnerabilities. Missing evidence: Pending verification of process implementation and records

View the JSON record (opens in a new tab).

Assessment result: unset.