How do you manage vulnerabilities?
A product security question from almost every security questionnaire. Here is a model answer, the evidence a reviewer may ask for, and what to say if you don't do this yet.
A model answer
Known vulnerabilities are tracked in [ticketing tool] and fixed in order of severity: critical within [7 days], high within [30 days]. Dependencies are scanned automatically with [tool] on every change.
Replace the parts in square brackets with what's true for you, and only answer yes to what you do.
Evidence a reviewer may ask for
- Your severity-based fix targets, in writing
- A recent report from your scanning tool
If you don't do this yet
State the targets you actually meet. If scanning is new, say when it started; a reviewer would rather see an honest recent start than an old promise.
Related questions
Do you perform penetration testing?A model answer, the evidence behind it, and what to say if you don't do it yet.Do you enforce multi-factor authentication?A model answer, the evidence behind it, and what to say if you don't do it yet.Security questionnaires without SOC 2How to answer a customer's questionnaire honestly before you have an audit.
Answer it once, on your trust center, for every reviewer.
From £39 a month. No sales call.