Purpose
Provide systematic procedures for proactive vulnerability discovery, intelligent remediation, and transparent security communication across all Hack23 projects, with measurable SLAs aligned with business impact.
Rules
Severity Classification and SLAs
| Severity | CVSS Score | SLA | Escalation |
|---|---|---|---|
| Critical | 9.0-10.0 | 7 days | CEO immediate |
| High | 7.0-8.9 | 30 days | CEO within 1 day |
| Medium | 4.0-6.9 | 90 days | Weekly review |
| Low | 0.1-3.9 | 180 days | Monthly review |
Detection Sources
MUST enable on all repositories:
- GitHub Dependabot for automated dependency vulnerability alerts
- GitHub CodeQL for code-level vulnerability scanning
- GitHub Secret Scanning for credential exposure
- OWASP Dependency Check (where applicable)
Vulnerability Lifecycle
Phase 1: Discovery
- MUST enable automated scanning on all repositories
- MUST process vulnerability alerts within 24 hours of detection
Phase 2: Assessment
- MUST evaluate CVSS score, exploitability, attack surface, and data exposure
- MUST consider contextual risk (is the vulnerable component reachable?)
- MUST document risk assessment for each vulnerability
Phase 3: Remediation
- MUST prioritize patches and version upgrades as primary remediation
- MUST create security-prefixed branches for fixes:
security/CVE-YYYY-XXXXX - MUST include CVE reference and CVSS score in commit messages
- MUST validate fix with security scanners before merging
Phase 4: Verification
- MUST confirm vulnerability resolved by security scanner
- MUST ensure no new vulnerabilities introduced
- MUST pass all existing tests
Phase 5: Closure
- MUST document resolution in changelog
- MUST close associated GitHub Security Advisory
- MUST conduct lessons-learned for Critical/High severity
Risk Acceptance
Risk acceptance MUST:
- Be approved by CEO
- Be valid for maximum 90 days
- Include documented compensating controls
- Be tracked in the risk register
- Be reviewed monthly
Hack23 ISMS Policy References
Compliance Mapping
- ISO 27001:2022: A.8.8 (Technical Vulnerability Management)
- NIST CSF 2.0: DE.CM-8 (Vulnerability Scans), ID.RA (Risk Assessment)
- CIS Controls v8.1: Control 7 (Continuous Vulnerability Management)
- OWASP Top 10: A06:2021 (Vulnerable and Outdated Components)