The very first action in vulnerability management is confirmingwhether the affected technology exists in the organization’s environment.
CRISC notes:
“Before prioritizing or mitigating, it is critical to determine whether the enterprise uses the affected asset or service.”
If the organization isnot usingthe affected technology, no further response is required.
After that, severity and mitigating controls are reviewed.
Hence,Cis correct.
CRISC Reference:Domain 2 – IT Risk Assessment, Topic: Vulnerability and Asset Validation.
Contribute your Thoughts:
Chosen Answer:
This is a voting comment (?). You can switch to a simple comment. It is better to Upvote an existing comment if you don't have anything to add.
Submit