APPS-4 Dependency Vulnerability Monitoring

What is APPS-4 Dependency Vulnerability Monitoring Control?

Dependency vulnerability monitoring helps automatically find security vulnerabilities in any third-party software dependencies used while developing and testing your applications. As organizations increase their usage of third-party software, it becomes more important to track and monitor any vulnerabilities that may arise from these relationships.

Available tools in the marketplace

The following listing is “crowdsourced” from our customer base or from external research. TrustCloud does not personally recommend any of the tools below, as we haven’t used them.

Vulnerability Scanning Tools

Snyk

Gitlab Dependency scanning –

GitHub Dependabot –

Available templates

TrustCloud has a curated list of templates, internally or externally sourced, to help you get started. Click on the link for a downloadable version.

• N/A: No template recommendation is made for this control

Control implementation

To implement this control,

1. Install a vulnerability monitoring tool to monitor for third-party dependencies.
   1. The tool must be configured to run continuously or on a frequent schedule (the schedule is up to each company to determine).
   2. The tool must be configured to send a notification or alert when issues are found.
2. Implement a formal and repeatable way to resolve any issues identified. The issues must be resolved promptly (timeliness is up to each organization to define).

What evidence do auditors look for?

Most auditors, at a minimum, are looking for the below-suggested action:

1. Provide screenshots of the tool’s settings screen(s), showing that it is configured to check dependencies across your codebase.
2. Provide a remediation ticket or document outlining issues found through the tool that shows that actions were taken to remediate the issue.

Evidence example

For the suggested action, an example is provided below:

1. Provide screenshots of the tool’s settings screen(s), showing that it is configured to continuously or frequently analyze your code.
   The following screenshot shows an example of a tool.
   
2. Provide a remediation ticket or document outlining issues found through the tool that shows that actions were taken to remediate the issue.
   The following screenshot shows an example of remediation configuration (This can include more detailed evidence of remediation)