CTR Announcements

Highlights of IS.016 Vulnerability Management Standard

EOTSS IS.016 Vulnerability Management Standard documents the requirements to protect, detect and recover from vulnerabilities in the technology environment.  Topics include:  

• Processes to identify, classify and remediate vulnerabilities across all technology environments and platforms to reduce the Commonwealth’s exposure to cyber threats 
• Identify and scanning for vulnerabilities 
• Reviewing publicly facing web applications  
• Conducting penetration testing 
• Prioritizing risks of vulnerabilities (critical, high, medium, low) 
• Remediate vulnerabilities by deploying patches or making configuration changes as a mitigation strategy 
• Reporting vulnerabilities and stages of mitigation 

 The Executive Office of Technology Services and Security (EOTSS) publishes Enterprise Information Security Policies and Standards which must be included in a Department’s Internal Control Plan, implemented, tested, and included in staff training. These standards apply to all Executive Department offices and agencies and are the default standard for non-Executive Departments who have not adopted comparable cyber and data security standards as part of their Internal Control Plan.