Skip to content

RV.1: Identify and Confirm Vulnerabilities on an Ongoing Basis

Help ensure that vulnerabilities are identified more quickly so that they can be remediated more quickly in accordance with risk, reducing the window of opportunity for attackers.

RV.1.1

Gather information from software acquirers, users, and public sources on potential vulnerabilities in the software and third-party components that the software uses, and investigate all credible reports.

Implementation Examples
  • Example 1: Monitor vulnerability databases , security mailing lists, and other sources of vulnerability reports through manual or automated means.
  • Example 2: Use threat intelligence sources to better understand how vulnerabilities in general are being exploited.
  • Example 3: Automatically review provenance and software composition data for all software components to identify any new vulnerabilities they have.
References

RV.1.2

Review, analyze, and/or test the software’s code to identify or confirm the presence of previously undetected vulnerabilities.

Implementation Examples
  • Example 1: Configure the toolchain to perform automated code analysis and testing on a regular or continuous basis for all supported releases.
  • Example 2: See PW.7 and PW.8.
References

RV.1.3

Have a policy that addresses vulnerability disclosure and remediation, and implement the roles, responsibilities, and processes needed to support that policy.

Implementation Examples
  • Example 1: Establish a vulnerability disclosure program, and make it easy for security researchers to learn about your program and report possible vulnerabilities.
  • Example 2: Have a Product Security Incident Response Team (PSIRT) and processes in place to handle the responses to vulnerability reports and incidents, including communications plans for all stakeholders.
  • Example 3: Have a security response playbook to handle a generic reported vulnerability, a report of zero-days, a vulnerability being exploited in the wild, and a major ongoing incident involving multiple parties and open-source software components.
  • Example 4: Periodically conduct exercises of the product security incident response processes.
References