topic Re: SOC Audit | Vulnerability Management in Tech Talk

SOC Audit | Vulnerability Management

SafiR — Thu, 07 Mar 2019 22:21:52 GMT

Does SOC or ISO audits require an organization to identify time to mitigate in their patching policies?
For example, 30 day for critical vulnerabilities, 60 days for high....etc.
If yes, is there a minimum acceptable time frame for a SOC auditor or for ISO27001 compliance?

Re: SOC Audit | Vulnerability Management

Rick_Roach — Fri, 08 Mar 2019 16:21:00 GMT

For SOC2 audits, the auditors usually measure if you're mitigating vulnerabilities in accordance with your policy. However, policy should be in alignment with industry best practice (NIST, CIS, etc.). If your policy states that you have two years to remediate a critical vulnerability, that would be an issue. The leading practice is typically 15-30 days for critical, 30-60 days for high, 60-90 days for medium, and aligned with org's configuration management policy for low/informational.

Re: SOC Audit | Vulnerability Management

SafiR — Fri, 08 Mar 2019 18:37:48 GMT

Thank you @Rick_Roach