Safeguard 7.1 Establish and maintain a vulnerability management process
The written vulnerability management process covering enterprise assets, reviewed annually: the Govern Safeguard that opens Control 7.
Control 7 Continuous vulnerability management
CIS Control 7 Safeguards for finding and fixing vulnerabilities: the vulnerability management and remediation processes, automated operating system and application patching, internal and external scanning, and remediation.
Safeguard 7.2 Establish and maintain a remediation process
A risk-based remediation strategy written into a remediation process and reviewed at least monthly, which Safeguard 7.7 then applies to detected vulnerabilities.
Safeguard 7.3 Perform automated operating system patch management
Automated operating system updates on enterprise assets at least monthly, and the assessment metrics for update effectiveness, automation coverage and scan compliance.
Safeguard 7.4 Perform automated application patch management
Automated application updates on enterprise assets at least monthly: the application counterpart to Safeguard 7.3, measured with the same metrics.
Safeguard 7.5 Perform automated vulnerability scans of internal enterprise assets
Quarterly or more frequent automated scanning of internal assets, both authenticated and unauthenticated, with metrics for scan coverage and compliance.
Safeguard 7.6 Perform automated vulnerability scans of externally-exposed enterprise assets
Monthly or more frequent automated scanning of externally exposed assets: a tighter cadence than the quarterly internal scans in Safeguard 7.5.
Safeguard 7.7 Remediate detected vulnerabilities
Fixing detected software vulnerabilities through processes and tooling at least monthly, following the remediation process from Safeguard 7.2.
