Application Security · AS-Q12

Question: Are application vulnerabilities tracked, prioritized, and verified closed through a formal defect management process?

  1. Objective — Why This Matters
    Tracking and verifying fixes closes the feedback loop. Without this, vulnerabilities reappear and security posture stagnates.

  2. Maturity Levels (0–5)

0 — Unaware
No tracking; issues emailed or lost.
1 — Ad Hoc
Vulnerabilities logged but without ownership.
2 — Defined
Formal defect tracker with status and SLA.
3 — Managed
Risk-based prioritization and verification of fixes.
4 — Integrated
Automated import from scanners; dashboards for closure.
5 — Optimized
Continuous improvement driven by closure analytics.
  1. How to Level Up
From → To Actions
0 → 1 Log all findings in shared tracker.
1 → 2 Assign owners and define closure SLAs.
2 → 3 Add risk scoring and verify remediation.
3 → 4 Integrate scanner imports and dashboards.
4 → 5 Analyze trends to improve processes.

  1. People / Process / Technology Enablers
    People – QA, AppSec, Project Managers.
    Process – Vulnerability triage and SLA tracking.
    Technology – DefectDojo, Jira, Grafana.

  2. Evidence Required
    Tracker exports, SLA metrics, verification reports.

  3. Metrics / KPIs
    • percentage of vulnerabilities closed within SLA
    • number of recurring vulnerabilities
    • average age of open high-risk findings

  4. Low-Cost / Open-Source Options (MSME)

Purpose Tool Notes
Tracking DefectDojo Centralized vulnerability management.
Visualization Grafana Dashboards from issue tracker.
Automation Python scripts / Webhooks Auto-import scan data.

  1. Common Pitfalls
    Fixes not verified; closed issues reopen in later scans.

  2. Compliance Mapping

Standard Clauses / Notes
ISO 27001 A.8.28 / A.8.32.
NIST CSF 2.0 DE.CM-8 / RC.IM-1.
CERT-In 2022 Vulnerability closure expectation.
NIRMATA Scoring AS-Q12 ≥ Level 4 requires scanner-linked dashboards.