Requirement
In addition to the subcontrols in ECC control 2-10-3, cybersecurity requirements for technical vulnerabilities management of critical systems must include at least the following:
Sub-Controls
2-9-1-1
Requirement: Utilizing trusted methods and tools for vulnerabilities assessments.
2-9-1-2
Requirement: Assessing and remediating vulnerabilities (by installing security updates and patches) on technical components of critical systems at least once every month for external and internet-connected critical systems, and at least once every three months for internal critical systems.
2-9-1-3
Requirement: Immediately remediating for critical vulnerabilities, in line with change management processes approved by the organization.
References
- ECC – 2:2024 equivalent: 2-10-3
