Vulnerability landscape
The vulnerability landscape measure weights open vulnerabilities by severity and by the number of affected systems.
What the published 2016 guidance says
The vulnerability landscape measure weights open vulnerabilities by severity and by the number of affected systems. The construct multiplies a severity value, such as CVSS, by the affected system count, and sets the threshold according to the risk appetite. Evidence is the vulnerability assessment record. It is collected monthly or quarterly. Security analysts or a contracted third party own it, the analysts collect, and the security manager is the client. Results are aggregated by system group, such as external and internal networks or Unix systems.
What it means in practice
The vulnerability landscape measure weights open vulnerabilities by severity and affected systems. It aggregates a noisy data set into a number the risk owner can compare over time. Define the severity source and the system grouping before the first report.
Status of this record. For B.30, this page states the published 2016 guidance, not the DIS text. The DIS is at stage 40.60 and is not public. Check the published edition before you rely on the row.
What good looks like
Keep the vulnerability assessment data and the severity source. Calculate the weighted score by system group. Report the trend and the concentration. Review the grouping when the estate changes.
Evidence an assessor asks for
- Vulnerability managementVulnerability assessment reports with severity and affected-system counts
- Risk managementAggregated weighted scores per system group against the risk-appetite target
The question an assessor will ask
An assessor will ask for vulnerability assessment reports with severity and affected-system counts. The test for B.30 is whether that record can be produced for a live sample, not whether the guidance is described in a procedure.
Common gaps
- Severity counted without the number of affected systems
- No target set, so the score has nothing to be judged against
Before the next review
Before the next review, test this against one live record: severity counted without the number of affected systems.
What to check when the revision publishes
When DIS 27004 is published, compare the B.30 Vulnerability landscape record with this page. Ask whether the information need, the formula, the target, the frequency or the owner changes. Update the measure register and the kit, not the requirement, because the clause 9.1 duty stays as it is.