Guide 6: Managing and Auditing IT Vulnerabilities
This concise, 24-page guide was developed to help chief audit executives (CAEs) and internal auditors ask the right questions of IT security staff when assessing the effectiveness of their vulnerability management processes. The guide recommends specific management practices to help an organization achieve and sustain higher levels of effectiveness and efficiency and illustrates the differences between high- and low-performing vulnerability management efforts. After reading this guide, you will:

• Have a working knowledge of vulnerability management processes.
• Have the ability to differentiate between high- and low-performing vulnerability management organizations.
• Be familiar with the typical progression of capability - from a technology-based approach to a risk-based approach to an IT process-based approach.
• Provide useful guidance to IT management on best practices for vulnerability management.
• Be able to sell your recommendations more effectively to your chief information officer, chief information security officer, chief executive officer, and chief financial officer.

Authors
Sasha Romanosky, Heinz School of Public Policy and Management, Carnegie Mellon University
Gene Kim, Tripwire Inc. and IT Process Institute
Bridget Kravchenko, General Motors Corp.

Download this guide (PDF, 574KB).
Purchase the printed version.
Download GTAG 6 PowerPoint slides (PPT, 627 KB).
Download form for permission to translate to another language (PDF, 20 KB).

Training in relation to this GTAG
The IIA also offers training either on site at your location or as part of our seminars program. To find out more, go to Internet Security for IT Auditors (IIA/Deloitte)