← CIS Controls v8 in plain English

16.2 IG2

Control 16 / Application Software Security

Establish and Maintain a Process to Accept and Address Software Vulnerabilities

Think of it likeHaving a process for identifying and fixing weak spots in your home’s security.

In plain English

A standing process catches and addresses software vulnerabilities, much like a plan for fixing weak spots in the home.

Related CSF subcategories (unofficial mapping)

ID.RA-08: Processes for receiving, analyzing, and responding to vulnerability disclosures are established.PR.PS-06: Secure software development practices are integrated, and their performance is monitored throughout the software development life cycle.