Vulnerability Management Policy
Purpose
Vulnerability management is the process of searching for, prioritizing, and remediating vulnerabilities in enterprise systems and software. The Vulnerability Management Policy provides the processes and procedures for ensuring enterprise assets do not contain vulnerabilities. This policy applies to all departments and all assets connected to the enterprise network.
Responsibility
The IT business unit is responsible for all vulnerability management functions. Specifically, administrators are responsible for assessment and application of patching. Necessary vulnerability information must be relayed to other business units within the enterprise such as finance, accounting, and cybersecurity as required or needed. IT is responsible for informing all users of their responsibilities in the use of any assets assigned to them, such as applying updates in a regular manner or restarting their systems.
Exceptions
Exceptions to this policy are likely to occur. Request for exceptions may include to not scan a device, or additional time to remediate vulnerabilities, or to let certain systems function normally with vulnerabilities in place. Exception requests must be made in writing and must contain:
- The reason for the request,
- Risk to the enterprise of not following the written policy,
- Specific mitigations that will not be implemented,
- Technical and other difficulties in applying patches, and
- Date of review
Policy
Assess
- A process for performing vulnerability management must be established.
a. This process must be documented and approved.
b. At a minimum, the vulnerability management process must be reviewed on an annual basis or following significant changes within the enterprise.
c. IT must monitor vulnerability announcements and emerging threats applicable to enterprise asset inventory.
d. All systems connected to the enterprise network must be scanned for vulnerabilities. Some of the vulnerability scans take place daily and others take place weekly.
e. As part of the vulnerability management program, HCC will annually conduct a penetration test and will also do quarterly PCI penetration tests.
Prioritize
- Identified vulnerabilities must be prioritized, with more critical vulnerabilities addressed first.
Remediate
- A process for remediating identified vulnerabilities must be established.
- This process must be documented and approved.
- At a minimum, this process must be reviewed on an annual basis or following significant changes within the enterprise.
- Vulnerabilities that cannot be remediated must be submitted through the vulnerability exception process.
- Operating systems must be configured to automatically update unless an alternative approved patching process is used.
- Applications must be configured to automatically update unless an alternative approved patching process is used.
- All users of enterprise assets have a duty to install updates for business systems and applications in a timely manner.
- All users must ensure required reboots occur within a reasonable timeframe to ensure updates are properly installed.
- High severity vulnerabilities must be addressed as a matter of priority.
Monitor
- IT must subscribe to a threat information service to receive notifications of recently released patches and other software updates.
- IT must notify the decision-making authority if vulnerabilities are not mitigated in a timely manner.
- Every month, IT must create a report containing the status of all known vulnerabilities within the enterprise.
This standard shall be subject to periodic review to ensure relevancy.
Date: June 25, 2026
Approved By: Senior Leadership Team
Appendix A: Acronyms and Abbreviations
| Acronym | Expansion |
|---|---|
| CIS | Center for Internet Security |
| CIS Controls | Center for Internet Security Critical Security Controls |
| CISA | Cybersecurity and Infrastructure Security Agency |
| COTS | Commercial-off-the-shelf |
| CPE | Common Platform Enumeration |
| CVE | Common Vulnerabilities and Exposures |
| CVSS | Common Vulnerability Scoring System |
| DFIR | Digital Forensics and Incident Response |
| EDR | Endpoint Detection and Response |
| IG | Implementation Group |
| IoT | Internet of Things |
| ISAC | Information Sharing and Analysis Center |
| ISBN | International Standard Book Number |
| IT | Information Technology |
| MAC | Media Access Control |
| MDBR | Malicious Domain Blocking and Reporting |
| MS-ISAC | Multi-State Information Sharing and Analysis Center |
| NIST | National Institute of Standards and Technology |
| OS | Operating System |
| OSINT | Open-source intelligence |
| NVD | National Vulnerability Database |
| SIEM | Security Information and Event Management |
Appendix B: Glossary
| Term | Definition |
|---|---|
| Asset | Anything that has value to an organization, including, but not limited to, another organization, person, computing device, information technology (IT) system, IT network, IT circuit, software (both an installed instance and a physical instance), virtual computing platform (common in cloud and virtualized computing), and related hardware (e.g., locks, cabinets, keyboards). Source: Asset(s) - Glossary I CSRC (nist.gov) |
| Asset Inventory | An asset inventory is a register, repository or comprehensive list of an enterprise's assets and specific information about those assets. Source: Asset Inventory I FTA {dot.gov) |
| Asset Owner | The department, business unit, or individual responsible for an enterprise asset. Source: CIS |
| Cloud environment | A virtualized environment that provides convenient, on-demand network access to a shared pool of configurable resources such as network, computing, storage, applications, and services. There are five essential characteristics to a cloud environment: on-demand self-service, broad network access, resource pooling, rapid elasticity, and measured service. Some services offered through cloud environments include Software as a Service (SaaS), Platform as a Service (PaaS), and Infrastructure as a Service (laaS). |
| Enterprise assets | Assets with the potential to store or process data. For the purpose of this document, enterprise assets include end-user devices, network devices, non-computing/Internet of Things (loT) devices, and servers in virtual, cloud-based, and physical environments. Source: CIS Controls v8 |
| End-user devices | Information technology (IT) assets used among members of an enterprise during work, off-hours, or any other purpose. End-user devices include mobile and portable devices such as laptops, smartphones, and tablets as well as desktops and workstations. For the purpose of this document, end-user devices are a subset of enterprise assets. Source: CIS Controls v8 |
| Enterprise asset identifier | Often a sticker or tag with a unique number or alphanumeric string that can be tracked within an enterprise asset inventory. Source: CIS |
| Mobile end-user devices | Small, enterprise-issued end-user devices with intrinsic wireless capability, such as smartphones and tablets. Mobile end-user devices are a subset of portable end-user devices, including laptops, which may require external hardware for connectivity. For the purpose of this document, mobile end-user devices are a subset of end-user devices. Source: CIS Controls v8 |
| Network Devices | Electronic devices required for communication and interaction between devices on a computer network. Network devices include wireless access points, firewalls, physical/virtual gateways, routers, and switches. These devices consist of physical hardware as well as virtual and cloud-based devices. For the purpose of this document, network devices are a subset of enterprise assets. Source: CIS Controls v8 |
| Non-computing/ Internet of Things (IoT) devices | Devices embedded with sensors, software, and other technologies for the purpose of connecting, storing, and exchanging data with other devices and systems over the internet. While these devices are not used for computational processes, they support an enterprise's ability to conduct business processes. Examples of these devices include printers, smart screens, physical security sensors, industrial control systems, and information technology sensors. For the purpose of this document, non-computing/loT devices are a subset of enterprise assets. Source: CIS Controls v8 |
| Physical environment | Physical hardware parts that make up a network, including cables and routers. The hardware is required for communication and interaction between devices on a network. Source: CIS Controls v8 |
| Portable end-user devices | Transportable, end-user devices that have the capability to wirelessly connect to a network. For the purpose of this document, portable end-user devices can include laptops and mobile devices such as smartphones and tablets, all of which are a subset of enterprise assets. Source: CIS Controls v8 |
| Remote devices | Any enterprise asset capable of connecting to a network remotely, usually from public internet. This can include enterprise assets such as end-user devices, network devices, non-computing/Internet of Things (IoT) devices, and servers. Source: CIS Controls v8 |
| Servers | A device or system that provides resources, data, services, or programs to other devices on either a local area network or wide area network. Servers can provide resources and use them from another system at the same time. Examples include web servers, application servers, mail servers, and file servers. Source: CIS Controls v8 |
| User | Employees (both on-site and remote), third-party vendors, contractors, service providers, consultants, or any other user that operates an enterprise asset. Source: CIS |
| Virtual environment | Simulates hardware to allow a software environment to run without the need to use a lot of actual hardware. Virtualized environments are used to make a small number of resources act as many with plenty of processing, memory, storage, and network capacity. Virtualization is a fundamental technology that allows cloud computing to work. Source: CIS Controls v8 |
Appendix C: Implementation Groups
As a part of our most recent version of the CIS Controls, v8, we created Implementation Groups (IGs) to provide granularity and some explicit structure to the different realities faced by enterprises of varied sizes.
IG1
An IG1 enterprise is small- to medium-sized with limited IT and cybersecurity expertise to dedicate towards protecting IT assets and personnel. The principal concern of these enterprises is to keep the business operational, as they have a limited tolerance for downtime. The sensitivity of the data that they are trying to protect is low and principally surrounds employee and financial information. Safeguards selected for IG1 should be implementable with limited cybersecurity expertise and aimed to thwart general, non-targeted attacks. These Safeguards will also typically be designed to work in conjunction with small or home office commercial off-the-shelf (COTS) hardware and software.
IG2
An IG2 enterprise employs individuals responsible for managing and protecting IT infrastructure. These enterprises support multiple departments with differing risk profiles based on job function and mission. Small enterprise units may have regulatory compliance burdens. IG2 enterprises often store and process sensitive client or enterprise information, and they can withstand short interruptions of service. A major concern is loss of public confidence if a breach occurs. Safeguards selected for IG2 help security teams cope with increased operational complexity. Some Safeguards will depend on enterprise-grade technology and specialized expertise to properly install and configure.
| Safeguards | Number of Safeguards |
|---|---|
 The number of Safeguards an enterprise is expected to implement increases based on which group the enterprise falls into. |
153 TOTAL SAFEGUARDS |
| IG3 assists enterprises with IT security experts to secure sensitive and confidential data. IG3 aims to prevent and/or lessen the impact of sophisticated attacks. | 23 SAFEGUARDS |
| IG2 assists enterprises managing IT infrastructure of multiple departments with differing risk profiles. IG2 aims to help enterprises cope with increased operational complexity. | 74 SAFEGUARDS |
| IG1 is the definition of essential cyber hygiene and represents a minimum standard of information security for all enterprises. IG1 assists enterprises with limited cybersecurity expertise thwart general, no-target attacks. | 56 SAFEGUARDS |
IG3
An IG3 enterprise employs security experts that specialize in the different facets of cybersecurity (e.g., risk management, penetration testing, application security). IG3 assets and data contain sensitive information or functions that are subject to regulatory and compliance oversight. An IG3 enterprise must address availability of services and the confidentiality and integrity of sensitive data. Successful attacks can cause significant harm to the public welfare. Safeguards selected for IG3 must abate targeted attacks from a sophisticated adversary and reduce the impact of zero-day attacks.
If you would like to know more about the Implementation Groups and how they pertain to enterprises of all sizes, there are many resources that explore the Implementation Groups and the CIS Controls in general on our website at https://www.cisecurity.org/controls/cis-eentrols-list/.
Appendix D: CIS Safeguards Mapping
CIS Controls & Safeguards Covered by this Policy
This policy helps to bolster IG1 Safeguards in CIS Control 5 Continuous Vulnerability Management Table 1 shows which IG1 CIS Safeguards are covered by this policy as written.
Table 1 - Safeguards covered by IG1
| CIS Control | Policy Statement | CIS Safeguard | CIS Safeguard Description |
|---|---|---|---|
| 7.1 | Assess 1 Monitor 1 | Establish and Maintain a Vulnerability Management Process | Establish and maintain a documented vulnerability management process for enterprise assets. Review and updated documentation annually, or when significant enterprise changes occur that could impact this Safeguard. |
| 7.2 | Prioritize 1 Remediate 1, 4, 5, 6 Monitor 2 | Establish and Maintain a Remediation Process | Establish and maintain a risk-based remediation strategy documented in a remediation process, with monthly, or more frequent, reviews. |
| 7.3 | Remediate 2 | Perform Automated Operating System Patch Management | Perform operating system updates on enterprise assets through automated patch management on a monthly, or more frequent, basis. |
| 7.4 | Remediate 3 | Perform Automated Application Patch Management | Perform application updates on enterprise assets through automated patch management on a monthly, or more frequent, basis. |
Appendix E: References and Resources
Center for Internet Security®
https://www.cisecurity.org/
CIS Critical Security Controls®
https://www.cisecurity.org/controls/
CIS Controls v8 Guide to Enterprise Assets and Software
https://www.cisecurity.org/insights/white-papers/guide-to-enterprise-assets-and-software
Cybersecurity and Infrastructure Security Agency
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
MS-ISAC Threat Intelligence (TIP)
https://www.cisecurity.org/ms-isac/services/real-time-indicator-feeds
National Vulnerability Database
https://nvd.nist.gov/vuln/search