Vulnerability Management, Secure Configuration, and Patching
Vulnerability Management, Secure Configuration and Patching
This domain tests hardening standards, scan cadence, patch timelines, and how those apply to provider-managed services.
Requirement 2 requires configuration standards for all system components, covering hardening and removal of vendor defaults (2.2), and encryption of non-console administrative access (2.2.7). Requirement 6 requires critical and high-severity patches within one month of release (6.3.3), an inventory and vulnerability process for bespoke software (6.3.2), and management of payment-page scripts (6.4.3). Requirement 11 requires quarterly external scans by an Approved Scanning Vendor (11.3.1), quarterly internal vulnerability scans (11.3.2), and penetration testing at least annually and after significant changes (11.4).
Cloud rewrites the mechanics. Build golden images with hardened baselines through infrastructure as code, scan images in the pipeline, and replace rather than patch where possible. ASV scans originate from vendor IP ranges: allowlist them in security groups, WAF rules and CDN controls, or the scan fails - and a blocked scan is a finding, not an exemption. Provider-managed services are patched by the provider, but you must still track versions, confirm the provider's responsibility in writing, and show how you monitor.
Worked example. A quarterly ASV scan reports the external load balancer as unscannable because the WAF returns a custom block page. The team wants to mark it a false positive. Correct handling: allowlist the ASV source ranges for the scan window, rerun, attach the clean report, and document the WAF change record. If a service genuinely cannot be scanned, escalate to the acquirer or assessor with a compensating control rather than self-certifying. Reasoning: evidence must show the control was exercised, not that the finding was argued away.
Traps. Assuming the provider patches your guest OS or container base images; scanning only public IPs; annual penetration testing not repeated after a re-architecture; managed-service versions nobody tracks.