NIST CSF 2.0, IdentifyID.RA-01

Maintain practices, capabilities, processes and tools to identify and assess cyber security weaknesses that external and insider threat actors could exploit, and design, implement and maintain multi-layer preventive controls and continuous security detection capabilities.

Develop, document and implement vulnerability management procedures that identify trustworthy information resources, perform automated vulnerability scanning and assessments (at least weekly for the ICT assets supporting critical or important functions), verify that ICT third-party service providers handle vulnerabilities and report at least the critical ones, track third-party and open-source libraries used by ICT services supporting critical or important functions, establish procedures for the responsible disclosure of vulnerabilities to clients, counterparties and the public, and prioritize the deployment of patches (Article 10(1) and (2)). Develop, document and implement patch management procedures that identify emergency procedures and set deadlines for installing patches and updates with escalation procedures in case those deadlines cannot be met (Article 10(3) and (4)).

Include in the program a range of appropriate tests, such as vulnerability assessments and scans, open source analyses, network security assessments, gap analyses, physical security reviews, source code reviews where feasible, scenario-based tests, compatibility testing, performance testing, end-to-end testing and penetration testing (Article 25(1)). If you are a central securities depository or central counterparty, perform vulnerability assessments before any deployment or redeployment of applications and infrastructure components and of the ICT services supporting critical or important functions (Article 25(2)). If you are a microenterprise, combine a risk-based approach with strategic planning of ICT testing (Article 25(3)).

The Department says you should reassess your procedures for evaluating the criticality and threat of known vulnerabilities and review your vulnerability management timelines to determine whether accelerated detection and remediation processes are necessary, based on your updated risk assessments.

Before or while selling an information and communication technology product in Benin, have an independent security expert accredited by the ministry in charge of electronic communications carry out a vulnerability test and a security assurance evaluation of the product.

When you detect or receive information about a potential vulnerability affecting a certified ICT product, record it and carry out a vulnerability impact analysis (Article 33(3)).

Monitor any residual vulnerabilities to ensure that they cannot be exploited if the operational environment changes (Article 35(7)).