Internal Use

Vulnerability Management Policy

Dispel

Document Control

1. PURPOSE AND SCOPE

1.1 Purpose

The purpose of this policy is to define Dispel’s requirements for identifying, assessing, tracking, and remediating vulnerabilities in systems and applications in order to reduce security risk.

1.2 Scope

This policy applies to:

• All Dispel product systems and supporting infrastructure.
• All environments where Dispel code or configurations run (including cloud platforms and third-party services in scope for the security program).

1.3 Regulatory and Framework Alignment

2. POLICY STATEMENTS

2.1 Management Commitment

Management Commitment Statement

Senior Management at Dispel is dedicated to the protection of our information assets, industrial control systems, and Protected Health Information (PHI). We assume full accountability for the effectiveness of our security program, ensuring it is integrated into all business processes and aligned with our strategic goals. To maintain compliance with ISO 27001, IEC 62443, HIPAA, and NIST 800-53, we formally commit to:

• Resource Provisioning: Providing the necessary financial, technical, and human resources to sustain a robust security posture.
• Risk-Based Governance: Approving security policies and overseeing a continuous risk management process that prioritizes both data privacy and operational safety.
• Operational Resilience: Supporting the security of industrial automation and control systems (IACS) to ensure safety and reliability.
• Continuous Oversight: Conducting regular management reviews to evaluate program performance, audit results, and opportunities for improvement.

2.2 Primary Policy Statement

Dispel SHALL identify, assess, and remediate vulnerabilities in systems and applications within risk-appropriate timeframes, using independent scanning and testing where appropriate.

2.3 Secondary Policy Statement

• Vulnerability management activities SHALL be integrated with change management and incident response.
• Vulnerability findings and remediation status SHALL be tracked and retained for compliance and audit purposes.

3. REQUIREMENTS

3.1 Vulnerability Scanning and Assessment

Objective: Systematically identify vulnerabilities in Dispel systems and infrastructure.

Mandatory Activities:

1. Vulnerability scanning SHALL be performed at a defined cadence (e.g., at least quarterly) using automated tools and/or third-party services.
2. Scanning SHALL cover relevant assets, including servers, applications, containers, and supporting infrastructure.
3. Findings from vulnerability scans SHALL be reviewed and analyzed for impact and likelihood.

Required Outputs:

• Vulnerability scan results.
• Records of analysis and prioritization.

3.2 Penetration Testing

Objective: Validate the effectiveness of security controls through controlled exploitation attempts.

Mandatory Activities:

1. Penetration testing SHOULD be performed regularly by an independent party for high-risk systems and significant changes.
2. Findings from penetration tests SHALL be analyzed and entered into the vulnerability tracking process.

Required Outputs:

• Penetration test reports.
• Records of remediation actions.

3.3 Vulnerability Tracking, Prioritization, and Remediation

Objective: Ensure vulnerabilities are consistently reported, prioritized, and remediated.

Mandatory Activities:

1. Vulnerability findings SHALL be recorded in a tracking system and assigned to owners.
2. Findings SHALL be prioritized based on severity and context (e.g., exposure, exploitability, business impact).
3. Remediation SHALL be performed according to defined SLAs based on severity (e.g., Critical, High, Medium, Low).
4. Exceptions to remediation timelines SHALL require documented risk acceptance by appropriate management.

Required Outputs:

• Vulnerability tracking records.
• SLA adherence metrics and exception approvals.

4. ROLES AND RESPONSIBILITIES

4.1 Policy Owner

Responsibilities:

• Owns this Vulnerability Management Policy.
• Ensures integration with Risk Assessment, System and Information Integrity, and Incident Response policies.

4.2 Security Officer / Vulnerability Management Function

Responsibilities:

• Coordinate vulnerability scanning, penetration testing, and remediation efforts.
• Maintain vulnerability tracking and reporting.

4.3 System Owners

Responsibilities:

• Ensure vulnerabilities affecting their systems are assessed and remediated.
• Implement configuration and code changes required to address vulnerabilities.

5. PROCEDURES

5.1 Vulnerability Management Lifecycle (High-Level)

6. MONITORING AND COMPLIANCE

Compliance with this policy SHALL be monitored through:

• Reviews of vulnerability scan and test results.
• Audits of vulnerability tracking records and remediation timelines.

7. EXCEPTIONS AND WAIVERS

Exceptions to this policy SHALL follow the documented exception management process and require appropriate approvals.

8. DEFINITIONS

Vulnerability: A weakness in an information system, system security procedures, internal controls, or implementation that could be exploited.

9. REFERENCES

• Risk Assessment Policy and Procedures.
• System and Information Integrity Policy and Procedures.
• NIST SP 800-53, RA and SI families.

10. DOCUMENT HISTORY

11. APPROVAL SIGNATURES

APPENDICES

Appendix A: Supporting Vulnerability Management Procedures

Appendix B: Additional Guidance and Examples