1. Document Control

• Document Title: Vulnerability Management Procedure

• Document Identifier: PRC-IT-005

• Version Number: v1.0

• Approval Date: <24 June 2025>

• Effective Date: <24 June 2025>

• Review Date: <24 June 2026>

• Document Owner: <Director of Information Security>

• Approved By: <Information Security Governance Committee>

2. Purpose

The purpose of this Vulnerability Management Procedure is to systematically identify, assess, prioritize, and remediate security vulnerabilities across ’s IT infrastructure, applications, and services. By implementing this procedure, aims to reduce the risk of exploitation by internal or external threats, prevent data breaches, and maintain the confidentiality, integrity, and availability of its systems.

This document supports regulatory and certification frameworks including SOC 2 (CC8.1, CC8.2) and ISO/IEC 27001:2022 (specifically controls A.8.8 and A.8.9), which mandate regular identification and remediation of security weaknesses. The procedure also helps enforce a proactive security posture and demonstrate audit-readiness.

3. Scope

This procedure applies to all managed IT assets, including servers, endpoints, virtual machines, containers, cloud services, network devices, and software applications. It covers both internally hosted and cloud-hosted systems across all locations and business units.

All personnel involved in IT administration, security operations, DevOps, and software development must comply with this procedure. The process encompasses vulnerability scanning, classification, triage, remediation, validation, and exception handling.

4. Policy Statement

shall maintain an enterprise-wide vulnerability management process to ensure timely identification and remediation of known weaknesses in its IT assets. This includes:

1. Weekly automated scanning of infrastructure and endpoints for vulnerabilities.

2. Monthly authenticated scanning of critical systems.

3. Immediate investigation and triage of any vulnerabilities classified as "Critical" or "High" by CVSS standards.

4. Patch or mitigate critical vulnerabilities within 7 business days.

5. Documented remediation plans for vulnerabilities not immediately fixable.

6. Periodic vulnerability assessments conducted by independent third parties.

7. Continuous integration of threat intelligence and vendor advisories into risk prioritization.

All findings must be logged, tracked, and closed within specified SLAs. Any deviation requires formal approval and compensating controls.

5. Safeguards

6. Roles and Responsibilities

• Director of Information Security: Owns and enforces this procedure; approves exceptions.

• Security Operations Center (SOC): Executes scans, validates remediation, manages dashboards.

• IT Administrators/Engineers: Remediate vulnerabilities on assigned systems.

• DevOps/Developers: Fix code-level vulnerabilities in applications.

• Compliance and Audit Teams: Review reports and validate adherence to timelines.

• Third-Party Vendors: Must remediate findings within SLA on managed systems.

7. Compliance and Exceptions

Compliance with this procedure is enforced through weekly compliance dashboards, monthly vulnerability metrics, and quarterly internal audits. Any vulnerability exceeding SLA without approved mitigation will be escalated to the CISO.

Exceptions must be documented using the “Vulnerability Exception Request Form,” approved by the Director of Information Security. Each exception must include a defined expiration date and documented compensating controls such as segmentation, monitoring, or virtual patching.

8. Enforcement

Non-compliance with this procedure may lead to disciplinary actions, including but not limited to additional training, written warnings, and in cases of gross negligence, termination. Vendors or contractors may be subject to penalties, including termination of contract or liability for damages if a breach results.

Enforcement actions are governed by HR, Legal, and InfoSec, ensuring proportional response aligned with risk impact and intent.

9. Related Policies/Documents

• POL-ALL-009: Change Management Policy

• POL-ALL-007: Logging and Monitoring Policy

• PRC-IT-004: Patch Management Procedure

• ISO 27001:2022 Controls A.8.8 (Management of Technical Vulnerabilities), A.8.9 (Configuration Management)

• SOC 2 Criteria: CC8.1 (System Changes), CC8.2 (Security Vulnerability Management)

10. Review and Maintenance

This procedure will be reviewed annually or following significant changes in technology, threat landscape, or audit findings. Reviews are led by the Information Security Office and documented through formal version control and approval workflows.