VPM-03: Attack Surface Scope
Mechanisms exist to define and manage the scope for its attack surface management activities.
Renumbered: Formerly VPM-01.1 in SCF 2025.4.
Code reused: In SCF 2025.4 and earlier, VPM-03 was Vulnerability Ranking. That control is now VPM-05.
Control Question: Does the organization define and manage the scope for its attack surface management activities?
General (26)
| Framework | Mapping Values |
|---|---|
| AICPA TSC 2017:2022 (used for SOC 2) (source) | CC2.2-POF9 CC3.2-POF7 CC3.2-POF9 CC3.4-POF6 CC9.2-POF13 |
| CSA CCM 4.1.0 | TVM-03 |
| CSA IoT SCF 2 | CLS-06 VLN-02 |
| ISO 27002 2022 | 8.8 |
| ISO 27018 2025 | 8.8 |
| ISO 42001 2023 | 4.3 |
| MPA Content Security Program 5.3.1 | TS-4.0 |
| NIST 800-53 R5.2 | SA-11(06) SA-11(07) |
| NIST 800-82 R3 | SA-11(06) SA-11(07) |
| NIST 800-160 Vol2 R1 | SA-11(06) |
| NIST 800-171 R3 (source) | 03.11.02.a 03.14.01.a |
| NIST 800-171A R3 (source) | A.03.11.02.a[01] A.03.14.01.a[01] |
| NIST 800-172 R3 | 03.12.01E |
| NIST 800-172A R3 | A.03.12.01E.ODP[02] |
| NIST CSF 2.0 (source) | PR.PS-02 |
| PCI DSS 4.0.1 (source) | 6.3.1 6.3.2 11.3.1 11.3.1.1 11.3.1.2 11.3.1.3 11.3.2 11.3.2.1 |
| PCI DSS 4.0.1 SAQ A (source) | 6.3.1 11.3.2 11.3.2.1 |
| PCI DSS 4.0.1 SAQ A-EP (source) | 6.3.1 6.3.2 11.3.2 11.3.2.1 |
| PCI DSS 4.0.1 SAQ B-IP (source) | 6.3.1 11.3.2 |
| PCI DSS 4.0.1 SAQ C (source) | 6.3.1 11.3.1 11.3.1.3 11.3.2 11.3.2.1 |
| PCI DSS 4.0.1 SAQ C-VT (source) | 6.3.1 |
| PCI DSS 4.0.1 SAQ D Merchant (source) | 6.3.1 6.3.2 11.3.1 11.3.1.1 11.3.1.2 11.3.1.3 11.3.2 11.3.2.1 |
| PCI DSS 4.0.1 SAQ D Service Provider (source) | 6.3.1 6.3.2 11.3.1 11.3.1.1 11.3.1.2 11.3.1.3 11.3.2 11.3.2.1 |
| SCF DPMP 2026 | 5.15 |
| SWIFT CSF 2025 | 2.2 2.7 |
| TISAX ISA 6.0.3 | 5.2.5 |
US (8)
| Framework | Mapping Values |
|---|---|
| USA Federal CISA CPG 2022 | 1.E 1.F |
| USA Federal C2M2 2.1 | THREAT-1e |
| USA Federal DoW BaTB IT 2026 | 6 |
| USA Federal IRS 1075 2021 | SA-11(CE-6) |
| USA Federal 33 CFR Part 101 Subpart F | 101.625(d)(15) |
| USA Federal FCA CRM 2023 | 609.930(c)(2) |
| USA California CCPA 2025 | 7123(c)(5)(D) |
| USA New York DFS 23 NYCRR500 2023 Amd 2 | 500.5(a)(1) |
EMEA (4)
| Framework | Mapping Values |
|---|---|
| EMEA Germany C5 2026 | OIS-08.02B.3 |
| EMEA Saudi Arabia CSCC-1 2019 | 2-10-1-1 |
| EMEA Saudi Arabia ECC-1 2018 | 5-1-3-8 |
| EMEA Saudi Arabia OTCC-1 2022 | 2-9-1-1 2-10-1-1 |
APAC (3)
| Framework | Mapping Values |
|---|---|
| APAC Malaysia RMiT 2025 | 10.18(a) |
| APAC New Zealand NZISM 3.9 | 6.2.4.C.01 |
| APAC Singapore MAS TRM 2021 | 6.1.4 13.1.2 |
Americas (1)
| Framework | Mapping Values |
|---|---|
| Americas Canada ITSP-10-171 2025 | 03.11.02.A 03.14.01.A |
Capability Maturity Model
Level 0 — Not Performed
Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.
Level 1 — Performed Informally
Vulnerability & Patch Management (VPM) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include: ▪ Policies, standards & procedures associated with VPM domain capabilities provide limited coverage due to the depth and breadth of the existing documentation. ▪ Attack Surface Management (ASM)-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.
Level 2 — Planned & Tracked
Vulnerability & Patch Management (VPM) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with VPM domain capabilities are formally documented and centrally-managed by the entity. ▪ Standardized Operating Procedures (SOP) associated with VPM domain capabilities are documented and maintained by process owners. ▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with VPM domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD). ▪ Vulnerability management-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines). ▪ Vulnerability management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel. ▪ IT and/or cybersecurity personnel define the breadth and depth of coverage for vulnerability scanning that covers system components scanned and types of vulnerabilities that are checked for.
Level 3 — Well Defined
Vulnerability & Patch Management (VPM) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with VPM domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function. ▪ Standardized Operating Procedures (SOP) associated with VPM domain capabilities are well-documented and kept current by process owners. ▪ A vulnerability management team, or similar function, is appropriately staffed and supported to implement and maintain VPM domain capabilities. ▪ Technology is leveraged to enhance the efficiency and accuracy of vulnerability management operations (e.g., patch management solution and vulnerability scanning solution). ▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with VPM domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls). ▪ An implemented and operational capability exists to define and manage the scope for its attack surface management activities.
Level 4 — Quantitatively Controlled
Utilize SCR-CMM Level 3 criteria definitions: ▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. ▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.
Level 5 — Continuously Improving
Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions: ▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. ▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies. ▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
Assessment Objectives
- VPM-03_A01 the breadth of testing and evaluation of required controls is defined.
- VPM-03_A02 the depth of testing and evaluation of required controls is defined.
- VPM-03_A03 system, applications and services are monitored for vulnerabilities per an organization-defined frequency.
- VPM-03_A04 systems and system components are included in the scope of the specified enhanced security requirements.
- VPM-03_A05 systems and system components that are not included in systems and system components are segregated in purpose-specific networks.
- VPM-03_A06 the developer of the system, system component or system service is required to perform attack surface reviews.
- VPM-03_A07 the developer of the system, system component, or system service is required to perform vulnerability analyses during the subsequent testing and evaluation of the system, component, or service that produces evidence that meets an organization-defined breadth.
- VPM-03_A08 the developer of the system, system component, or system service is required to verify that the scope of testing and evaluation provides complete coverage of the required controls at an organization-defined depth.
- VPM-03_A09 the system is monitored for vulnerabilities <A.03.11.02.ODP[01]: frequency>.
Evidence Requirements
- E-VPM-06 Attack Surface Scope
-
Documented evidence of the organization defining its attack surface (e.g., may be in the form of graphical network diagrams or other forms of written documentation).
Vulnerability & Patch Management
Technology Recommendations
Micro/Small
- Identify what systems and software are in scope for security testing
Small
- Attack surface inventory
- Define scope for vulnerability management
Medium
- Formal attack surface scoping process
- Asset-driven attack surface management
Large
- Enterprise attack surface management (ASM) program
- Automated attack surface discovery
Enterprise
- Enterprise ASM platform (e.g., CyCognito, Mandiant ASM)
- Automated continuous attack surface monitoring