This policy procedure sets out how technical vulnerabilities in the network and in software are identified, tested for, addressed and then retested.

Effective Policy Templates

This policy template is supplied in fully editable MS Word format and can be easily customised and edited. The document uses pre-defined style formatting throughout, with all text in Calibri font for improved readability.
The following document labelling is included in the footer:

• Policy number and title
• Information-classification
• Version
• Page number / total pages

alphaZ documents - beautifully designed, tried and tested policy templates. No junk, jargon or unnecessary content. Simple and usable policy templates developed over 25 years through practical use in the real world.

Further Reading

Further guidance on technical vulnerabilities:

• Malware, Anti-Malware and Patching
• Cybersecurity
• Information Security Risk Management
• Information Security knowledge base

Logo Update Service

Download this policy with your company name and logo already added!
Document Preparation is included with the alphaZ subscription.

How to Download

This file is included in the alphaZ subscription.

Need Help Implementing?

If you'd like hands-on help planning vulnerability testing and penetration tests, our remote support services provide direct expert input from our team, by the day, by project, or on an ongoing basis.

Technical Vulnerability Management Policy Procedure Template

The Technical Vulnerability Management Policy Procedure is a Word template that sets out how a business detects and prevents technical vulnerabilities. It covers risk assessment of vulnerabilities and the impact of leaving them unaddressed, weaknesses in the network and in software being developed or modified, penetration testing by internal or third party resources, and retesting after action is taken.

It applies to all employees and company activities, with disciplinary action for breaches. The file has Title, File Location, Issue No, Issue Date, Controlled By and Approved By fields, an Amendment Record and a Business Use information classification in the footer.

What the Policy Covers

• Amendment record, summary, scope and applicability - the purpose of detecting and preventing technical vulnerabilities, the activities and staff covered, and disciplinary action for breaches
• Management of vulnerability risks - periodic risk assessments of technical vulnerabilities and the potential impact of not addressing them, with findings actioned
• Network and software vulnerabilities - all identified risks reviewed and addressed, covering the company network and any software being developed or modified
• Testing and retesting - vulnerability tests built into development, penetration testing as required, and retesting to confirm the actions taken have worked
• Use of third party testers - testing carried out by an internal resource or a third party, with only company approved suppliers used for outside testing

Built for Finding and Fixing Weaknesses

• A vulnerability test included as a natural part of any software development or modification
• Penetration testing completed as required, by an internal resource or a third party
• Identified vulnerabilities addressed and retested to confirm the actions taken were effective
• Only company approved suppliers used where testing is carried out by a third party

Who Needs a Technical Vulnerability Management Policy Procedure?

Businesses that run their own network or develop or modify software, and want a set approach to finding and dealing with technical weaknesses.

Using the Policy

Edit when penetration testing is carried out and who carries it out to match your own arrangements, and name the person in the Controlled By field. Give it top level approval and brief those who develop, modify or manage your systems.

Related Documents

GG-8-03 Software and Malware Guidance and TT-8-03 Software and Malware Training Talk help managers and staff with the wider software and malware controls.

Vulnerability Testing in Development

For any software the business develops or modifies, a test for vulnerability is a natural part of the development process rather than a separate exercise. Any weaknesses found are addressed and then retested to validate that the action taken has been effective.

Network and Software in Scope

Vulnerability management covers both the company network and any software being developed or modified. Every identified risk related to a technical vulnerability is reviewed and addressed, and the periodic risk assessments also weigh up the potential impact of leaving a vulnerability unaddressed, with their findings actioned and the policy amended to match the controls in place.