control
vulnerability management
Knowing what is exposed, deciding how fast each flaw gets fixed and showing that it was. NIS2 names vulnerability handling, DORA names the testing, and the CRA sets update duties for product makers.
- what it protects
- the flaws in what you run, before an outsider finds them
- who owns it
- head of IT
- start with
- what faces the internet, then servers, laptops and network devices
what it is
Vulnerability management is the routine of finding flaws in the software and devices you run, deciding how fast each one has to be fixed and checking that it was. It is a loop that repeats, with a list of assets at the start of it and a record at the end.
NIS2 names vulnerability handling as part of security in acquisition, development and maintenance, and sets no deadline for a patch. DORA lists vulnerability scans among the tests a financial entity runs. The CRA adds a duty on the makers of products to ship security updates without delay. Your target times are your own to set, and the proof is that you set them and kept to them.
Start with what faces the internet, because that is what an outsider can reach. Then widen to servers, laptops and network devices. Set a target time per severity, assign each finding to an owner and look at what is overdue every quarter.
basis NIS2 Art. 21(2)(e). The scope, the rhythm and the target times are practice.
the loop of vulnerability management
- 1asset listwhat you run, including what faces the internet
- 2scanthe list is checked for known flaws on a rhythm
- 3rankby severity and by how likely a flaw is to be used
- 4fix or acceptan owner fixes by the target time, or records the risk with an end date
- 5reportwhat was closed and what is overdue
repeat on a rhythm, and feed what you learn back into the asset list
basis working practice. No legal text sets this.
an example
Picture a company of 200 people that runs a scanner every month.
The scanner is pointed at the servers somebody remembered. The report has thousands of lines and no owner. An old test server on the public internet is not in it, and it is the one that gets used.
The asset list feeds the scanner, internet-facing systems are scanned first and every finding has an owner and a target time by severity. Overdue items show up in a quarterly report, and each accepted risk has a reason and an end date.
An illustration. It is not a real case.
what it has to do for each rule
| rule | where | what the text asks | what the control has to do |
|---|---|---|---|
| NIS2 | NIS2 Art. 21(2)(e) | Security in acquisition, development and maintenance of systems, including vulnerability handling and disclosure. | Keep a list of what you run, scan it on a rhythm, set target times by severity and record what was fixed. |
| IR 2024/2690 | IR 2024/2690 Annex 6.6 | Listed digital providers: security patch management. | Write the patch process down, with who decides and how an urgent patch differs from a routine one. |
| DORA | DORA Art. 25(1) | Testing such as vulnerability scans, network assessments and scenario tests. | Run scans on the systems that carry critical functions and keep the results with the actions taken. |
| CRA | CRA Annex I part II | Manufacturers: security updates without delay, regular security testing and public information about fixed vulnerabilities. | If you make a product, plan a way to ship fixes and to say what was fixed. If you buy one, ask the supplier how it does this. |
| GDPR | GDPR Art. 32(1)(d) | A process for regularly testing whether security measures work. | Count the scan and its follow-up as part of that process for systems with personal data. |
basis NIS2 Art. 21(2)(e); IR 2024/2690 Annex 6.6 as a reference; DORA Art. 25(1); CRA Annex I part II; GDPR Art. 32(1)(d). What the control has to do is practice.
what to look for when you choose
- Does it cover everything you run: servers, laptops, network devices, cloud services and the software installed on them, including machines it was not set up for?
- Does it see what faces the internet, from outside, as well as what is inside the network?
- Can it rank findings by how likely a flaw is to be used as well as by a technical score?
- Can you set a target time per severity and get a report of what is past it?
- Does each finding go to a named owner, with a status and a date, in the tool your IT team already uses?
- What happens to a machine that is off, travelling or on a segment the scanner does not reach?
- Can you record an accepted risk with a reason, an owner and an end date?
- How long does it keep the history, and can you export it for an audit?
basis working practice. No legal text sets this.
three levels, from first step to strong
Each level adds something visible. Stop where the risk you accepted allows.
- start
Scan what faces the internet, give every finding an owner and write down a target time per severity.
- solid
Feed the scanner from the asset list, report what is overdue every quarter and give each accepted risk a reason, an owner and an end date.
- strong
Rank by how likely a flaw is to be used as well as by score, cover machines that are off or travelling and check once a year that the scan really reaches everything on the list.
basis working practice. No legal text sets this.
where it goes wrong
a scan nobody reads
A report with thousands of findings and no owner shows that you looked. Rank, assign and close, starting with what faces the internet.
the list of assets is out of date
A scanner only sees what it is pointed at. Forgotten servers and old test systems are where the old flaws sit.
targets with no figures
A policy that says critical flaws are fixed fast, with no number and no report against it, cannot be checked by anyone.
accepted risks that never expire
Leaving a flaw open can be a fair decision. Without an owner and a review date it becomes a permanent one that nobody remembers making.
basis working practice. No legal text sets this.
the proof it leaves
| what you can show | who owns it | refresh |
|---|---|---|
| patch policy with target times by severity | head of IT | yearly |
| scan results and the actions taken | head of IT | monthly |
| figures against target, with what is overdue | head of IT | quarterly |
| accepted risks with owners and end dates | head of IT | quarterly |
basis practice. The rhythms are your choice.
check it yourself
- Directive (EU) 2022/2555 (NIS2) (EUR-Lex)
- Commission Implementing Regulation (EU) 2024/2690 (EUR-Lex)
- Regulation (EU) 2022/2554 (DORA) (EUR-Lex)
- Regulation (EU) 2024/2847 (Cyber Resilience Act) (EUR-Lex)
- Regulation (EU) 2016/679 (GDPR) (EUR-Lex)
your next step
List the systems that face the internet, run one scan against them and give each finding an owner.