AuditRubric
vulnerability-management

vulnerability-management Controls

5 controls across 4 frameworks.

CISA CPG

ds-5

Critical and high CVEs are patched within 14 days; all others within 30 days

Device Security / Device Security
vm-3

Critical and high vulnerabilities are remediated within defined SLAs

Vulnerability Management / Vulnerability Management

CMMC L1

cmmc-si-1

Identify, report, and correct information system flaws in a timely manner

System & Info Integrity / Flaw Remediation

NIST CSF

de-cm-8

Vulnerability scans are performed

Detect / Continuous Monitoring

SOC2

cc7-1

Vulnerability management identifies and remediates security flaws

Security / System Operations