VPM

Vulnerability & Patch Management

32 controls

Reduce exploitable weaknesses in Technology Assets, Applications and Services (TAAS) through coordinated vulnerability identification, prioritization, remediation and validation practices.

SCF #	Control Name	Weight	NIST CSF	Frameworks
VPM-01	Vulnerability & Patch Management Policy	10 — Critical	Govern	10
VPM-02	Vulnerability & Patch Management Program (VPMP)	9 — Critical	Govern	119
VPM-03	Attack Surface Scope	5 — Medium	Protect	42
VPM-04	Vulnerability Exploitation Analysis	5 — Medium	Protect	8
VPM-05	Vulnerability Ranking	8 — High	Identify	42
VPM-06	Vulnerability Remediation Process	10 — Critical	Protect	94
VPM-06.1	Centralized Management of Flaw Remediation Processes	9 — Critical	Protect	36
VPM-06.2	Continuous Vulnerability Remediation Activities	8 — High	Protect	46
VPM-06.3	Known Exploited Vulnerabilities (KEV) Mitigations	7 — High	Protect	3
VPM-07	Time To Remediate / Benchmarks For Corrective Action	6 — Medium	Protect	16
VPM-08	Software & Firmware Patching	10 — Critical	Protect	103
VPM-08.1	Automated Software & Firmware Updates	5 — Medium	Protect	17
VPM-08.2	Software Patch Integrity	9 — Critical	Protect	8
VPM-08.3	Automated Remediation Status	9 — Critical	Protect	21
VPM-09	Deferred Patching Decisions	2 — Low	Protect	7
VPM-10	Pre-Deployment Patch Testing	7 — High	Protect	12
VPM-11	Out-of-Cycle Patching	7 — High	Protect	5
VPM-12	Vulnerability Scanning	9 — Critical	Detect	98
VPM-12.1	Update Vulnerability Scanning Tools	8 — High	Protect	45
VPM-12.2	Breadth / Depth of Coverage For Vulnerability Scanning	8 — High	Protect	24
VPM-12.3	Privileged Access For Vulnerability Scanning Tools	9 — Critical	Protect	23
VPM-12.4	Reviewing Vulnerability Scanner Usage	3 — Low	Detect	0
VPM-13	Vulnerability Trend Analysis	9 — Critical	Identify	12
VPM-13.1	Review Historical Event logs	9 — Critical	Detect	8
VPM-14	External Vulnerability Assessment	9 — Critical	Detect	13
VPM-15	Internal Vulnerability Assessment	9 — Critical	Detect	10
VPM-16	Acceptable Discoverable Information	5 — Medium	Protect	18
VPM-17	Correlate Scanning Information	5 — Medium	Detect	7
VPM-18	Penetration Testing	9 — Critical	Detect	67
VPM-19	Independent Penetration Agent or Team	6 — Medium	Detect	25
VPM-20	Technical Surveillance Countermeasures Security	1 — Low	Detect	5
VPM-21	Red Team Exercises	3 — Low	Detect	19

The Secure Controls Framework (SCF) is maintained by SCF Council. Use of SCF content is subject to the SCF Terms & Conditions.

Vulnerability & Patch Management

Manage SCF Controls in SCF Connect