Part of Data Security Standard 6 - Responding to incidents
Acting upon known vulnerabilities (6.3.1 - 6.3.5)
Which vulnerabilities?
There are many sources of information relating to known threats and vulnerabilities listings. For health and care organisations, the referenced authoritative list is from NHS England.
Threats and vulnerabilities are often used terms and sometime can be incorrectly interchanged.
Threats
The possible danger that could lead to an incident which could result in harm to systems and the organisation.
Vulnerability
A vulnerability is a weakness which allows an attacker to compromise security (integrity, confidentiality or availability).
A threat could exploit a vulnerability (such as a gap) to lead to a potential incident. Not every threat will have a corresponding technical vulnerability, but it is very common. Cyber vulnerabilities are listed on our cyber alerts portal.
Last edited: 4 August 2023 8:18 am