Vulnerability Management

PCIComplianceHubLast updated

An ongoing process of identifying, evaluating, and mitigating vulnerabilities in systems and applications to reduce the risk of security incidents. Vulnerability management is an important aspect of PCI DSS compliance and overall information security.

Applies to. PCI DSS v4.0.1 does not use the phrase, but the lifecycle it describes is spread across two requirements. Requirement 6 covers identification: new vulnerabilities must be identified, ranked by risk and patched. Requirement 11 covers verification: internal and external vulnerability scans and penetration tests, with exploitable findings corrected and the scan or test repeated to confirm the fix.
Related. Vulnerability, Risk Ranking, Patch, Vulnerability Scanning, Penetration Testing
Sources. PCI DSS v4.0.1 (June 2024)