[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-seo-356549-105":3,"detail-sidebar-cat-1-en-105":81,"doc-detail-356549-en":127},{"code":4,"msg":5,"data":6},0,"ok",{"site_id":7,"language":8,"slug":9,"title":10,"keywords":11,"description":12,"schema_data":13,"social_meta":74,"head_meta":76,"extra_data":78,"updated_unix":80},105,"en","building-a-vulnerability-management-program-a-project-management-approach","Building a Vulnerability Management Program - A project management approach","","Examines the critical role of project management in establishing a successful vulnerability management program. Describes how organizational risk and regulatory compliance needs can be addressed using a Plan-Do-Check-Act approach. Explains vulnerability management as a disciplined process for detecting, removing, and controlling inherent software vulnerabilities through specialized software, workflows, risk prioritization, patch management, and follow-up remediation scanning to confirm fixes.",{"@graph":14,"@context":73},[15,34,56],{"@type":16,"itemListElement":17},"BreadcrumbList",[18,23,27,31],{"item":19,"name":20,"@type":21,"position":22},"https://docshare.wps.com","Home","ListItem",1,{"item":24,"name":25,"@type":21,"position":26},"https://docshare.wps.com/template/","Template",2,{"item":28,"name":29,"@type":21,"position":30},"https://docshare.wps.com/template/presentations/","Presentations",3,{"item":32,"name":10,"@type":21,"position":33},"https://docshare.wps.com/template/building-a-vulnerability-management-program-a-project-management-approach/356549/",4,{"url":32,"name":10,"@type":35,"image":36,"author":41,"headline":10,"publisher":44,"fileFormat":47,"inLanguage":8,"description":12,"dateModified":48,"datePublished":49,"encodingFormat":47,"isAccessibleForFree":50,"interactionStatistic":51},"DigitalDocument",{"url":37,"@type":38,"width":39,"height":40},"https://docshare.wps.com/thumbnails/building-a-vulnerability-management-program-a-project-management-approach/356549.png","ImageObject",442,249,{"name":42,"@type":43},"Grenda","Person",{"url":19,"name":45,"@type":46},"DocShare","Organization","application/pdf","2026-10-27","2026-09-23",true,{"@type":52,"interactionType":53,"userInteractionCount":55},"InteractionCounter",{"@type":54},"ViewAction",13,{"@type":57,"mainEntity":58},"FAQPage",[59,65,69],{"name":60,"@type":61,"acceptedAnswer":62},"Why is project management important for a vulnerability management program?","Question",{"text":63,"@type":64},"The paper emphasizes management sponsorship and structured execution so the program has the commitment, funding, staffing, and direction needed to succeed. It also ties effectiveness to a Plan-Do-Check-Act approach.","Answer",{"name":66,"@type":61,"acceptedAnswer":67},"What does vulnerability management focus on?",{"text":68,"@type":64},"It focuses on detecting, removing, and controlling inherent risk created by software vulnerabilities. The program uses specialized software and workflow to identify risks and guide remediation.",{"name":70,"@type":61,"acceptedAnswer":71},"What are the key components involved in vulnerability management?",{"text":72,"@type":64},"The paper lists activities such as building an asset inventory, categorizing assets, scanning for known vulnerabilities, ranking risks, patch management (including test patches and applying patches), and follow-up remediation scans to confirm vulnerabilities are addressed.","https://schema.org",{"og:url":32,"og:type":75,"og:title":10,"og:site_name":45,"og:description":12},"article",{"robots":77,"canonical":32},"index,follow",{"doc_id":79,"site_id":7},356549,1791716166,{"code":4,"msg":82,"data":83},"success",[84,88,93,98,103,108,113,118,123],{"id":85,"doc_module":22,"doc_module_name":25,"category_name":29,"show_sort_weight":86,"slug":87},11,90,"presentations",{"id":89,"doc_module":22,"doc_module_name":25,"category_name":90,"show_sort_weight":91,"slug":92},12,"Resumes",80,"resumes",{"id":94,"doc_module":22,"doc_module_name":25,"category_name":95,"show_sort_weight":96,"slug":97},14,"Invoices",70,"invoices",{"id":99,"doc_module":22,"doc_module_name":25,"category_name":100,"show_sort_weight":101,"slug":102},15,"Posters",60,"posters",{"id":104,"doc_module":22,"doc_module_name":25,"category_name":105,"show_sort_weight":106,"slug":107},16,"Social Media",50,"social-media",{"id":109,"doc_module":22,"doc_module_name":25,"category_name":110,"show_sort_weight":111,"slug":112},17,"Forms",40,"forms",{"id":114,"doc_module":22,"doc_module_name":25,"category_name":115,"show_sort_weight":116,"slug":117},18,"Letters",30,"letters",{"id":119,"doc_module":22,"doc_module_name":25,"category_name":120,"show_sort_weight":121,"slug":122},21,"Paper Templates",5,"papers-templates",{"id":124,"doc_module":22,"doc_module_name":25,"category_name":125,"show_sort_weight":4,"slug":126},158,"General","general-158",{"code":4,"msg":82,"data":128},{"doc_id":79,"user_id":129,"nickname":42,"user_avatar":130,"doc_module":22,"category_id":85,"category_name":29,"doc_title":10,"doc_description":12,"doc_content":131,"file_id":132,"file_url":133,"file_type":134,"file_size":135,"view_count":55,"is_deleted":4,"is_public":22,"is_downloadable":22,"audit_status":22,"page_count":136,"language":137,"language_code":8,"site_id":7,"html_lang":8,"table_of_contents":138,"faqs":139,"seo_title":140,"seo_description":12,"update_tm":141,"read_time":142},7971474921005,"https://ap-avatar.wpscdn.com/davatar_29158cc5080c5b710cf443261637dec0","Global Information Assurance Certification Paper  \nCopyright SANS InstituteAuthor Retains Full Rights  \nThis paper is taken from the GIAC directory of certified professionals.Reposting is not permited without express writen permission.  \nInterested in learning more?  \nCheck out the list of upcoming events offering  \n\"Managing Cybersecurity Initiatives &Effective Communication (Cybersecurity l  \nat http://www.giac.org/registration/gcpm  \n# Building a Vulnerability Management Program-A project management approach\n\nGIAC(GCPM)Gold Certification  \nAuthor:Wylie Shanks,giac@infosecmatters.com  \nAdvisor:Christopher Walker  \nAccepted:5/21/2015  \n## Abstract\n\nThis paper examines the critical role of project management in building a successfulvulnerability management program.This paper outlines how organizational risk andregulatory compliance needs can be addressed through a \"Plan-Do-Check-Act\"approachto a vulnerability management program.  \n## 1.Introduction\n\nIT security regulations increasingly are the norm demonstrating a standard of carein protecting sensitive data.To serve this standard,several regulatory bodies havemandated the creation of vulnerability management programs.Examples include:thePayment Card Industry Data Security Standard (PCI DSS),Health Insurance Portabilityand Accountability Act(HIPAA),and Federal Energy Regulation Committee(FERC).  \nVulnerability management programs address the inherent security weaknesscreated by software vulnerabilities.Known software vulnerabilities create opportunitiesfor criminals and other adversaries to exploit these weaknesses.These vulnerabilities mayresult in unauthorized access to a system or network,access to or theft of confidentialdata,resulting in regulatory,financial or reputational impact for business(VulnerabilityManagement for Dummies,2008).  \nBuilding a vulnerability management program requires management sponsorshipto provide the necessary commitment,funding,resources (staff and equipment),anddirection for the project to be successful.This paper examines the role of the “Plan-Do-Check-Act\"approach to project management in building a successful vulnerabilitymanagement program.  \nThe next section of this paper examines the vulnerability management program.  \n## 2.Vulnerability Management Program\n\nUnfortunately,new software vulnerabilities are discovered on a daily basis.Vulnerability management(VM)is the means of detecting,removing and controlling theinherent risk of vulnerabilities.The vulnerability management program utilizesspecialized software and workflow to help eliminate detected risks(VulnerabilityManagement for Dummies,2008).  \nScaling the vulnerability management program is important to address companyrequirements,complexity,and its IT environment.Even the smallest companies canoperate manual vulnerability management processes.However,the use of automation andworkflow are recommended to ensure consistency,compliance(task completion  \nassurance),and to reduce cost.The vulnerability management maturity model shownbelow illustrates the scalability of the vulnerability management program.  \nVULNERABILITY MANAGEMENT  \nMATURITY MODEL  \nLevel 0Level1Level2Level3Level 4Level5ASSESSMENT &ANALYSIS&ATTACKBUSINESS-RISKNON-EXISTENTSCANNINGCOMPLIANCEPRIORITIZATIONMANAGEMENTMANAGEMENTNo vulnerability scanningVulnerability assessmentDriven by regulatorysolution in placeframeworkRisk-focusedThreat and risk alignedwith business goalsManual vulnerabilityAd-hoc vulnerabilityScheduled vulnerabilityScan data prioritizedAll threat-vectorsassessmentsscanningscanningthrough analytisscanned and prionitizedHaphazard patchingRudimentary patchingScan to patch lifecyclePatching data-drivenPacho gbased on niskby priorityContinuous patching  \nNo processes existBasic processesEmerging processesMeasureable processesEfficient,metrics-basedUnifed business andprocessesII processesNo metricsBasicmeticsLittle measurability,meging ngtrsThreat-driven metricsMeasurement integrated tobusy metricsenterprise ris","cbCaicc8rzeKtZO3","https://ap.wps.com/l/cbCaicc8rzeKtZO3","pdf",1336361,22,"English","# Abstract\n# 1. Introduction\n# 2. Vulnerability Management\n## 2.1 Components of Vulnerability Management\n## 2.1.1 Build an asset inventory\n## 2.1.2 Categorizing assets\n## 2.1.3 Vulnerability scanning","[{\"question\":\"Why is project management important for a vulnerability management program?\",\"answer\":\"The paper emphasizes management sponsorship and structured execution so the program has the commitment, funding, staffing, and direction needed to succeed. It also ties effectiveness to a Plan-Do-Check-Act approach.\"},{\"question\":\"What does vulnerability management focus on?\",\"answer\":\"It focuses on detecting, removing, and controlling inherent risk created by software vulnerabilities. The program uses specialized software and workflow to identify risks and guide remediation.\"},{\"question\":\"What are the key components involved in vulnerability management?\",\"answer\":\"The paper lists activities such as building an asset inventory, categorizing assets, scanning for known vulnerabilities, ranking risks, patch management (including test patches and applying patches), and follow-up remediation scans to confirm vulnerabilities are addressed.\"}]","Building a Vulnerability Management Program - A project management approach | PDF",1790125923,8]