N.4.14 Detecting and repairing technical vulnerabilities in a timely manner
Control Overview
This control mandates that the organization establishes, assigns, and maintains formal operational processes to ensure the timely discovery, registration, risk evaluation, and remediation of technical vulnerabilities (such as software bugs, code flaws, and system misconfigurations) within its infrastructure and networks. To systematically prevent threat actors from exploiting unpatched flaws, the organization must implement continuous scanning, evaluate vulnerabilities using standard risk criteria, maintain automated code-level checks prior to deployment, and enforce binding remediation timelines (SLAs) tailored to vulnerability severity.
Applicability Note: This control is fully applicable to the anDREa platform and represents a core technical checkpoint within our continuous integration and continuous deployment (CI/CD) pipelines and production environments.
Compliance & Strategic Approach
Our approach satisfying this NIS 2 requirement operates within our ISO/IEC 27001-based ISMS, shifting vulnerability management from a manual check to an automated pipeline security model.
anDREa enforces a multi-layered vulnerability detection and patch routine that covers our entire source code and production environment lifecycle:
- Pre-Deployment Static Analysis: All source code undergoes static application security testing (SAST) via SonarCloud and automated quality gates prior to being authorized for deployment into the production environment.
- Continuous Dependency Scanning: Open-source libraries and component dependencies are programmatically evaluated every single day using automated tooling (GitHub Dependabot) to flag emerging vulnerabilities.
- Live Infrastructure Monitoring: The runtime cloud plane is monitored via automated vendor tooling, including Azure Security Center (Microsoft Defender for Cloud) and upstream security bulletins.
- Remediation SLA Enforcement: To ensure a predictable and legally compliant response to discovered flaws, A.08.08 - Management of technical vulnerabilities explicitly defines our binding remediation timelines (Patch SLAs) structured strictly by exploit criticality, preventing high-severity gaps from lingering in production.
Control Mappings & Evidence
| Framework / Document Reference | Element & Identifier | Description / Relationship to NIS 2 |
|---|---|---|
| ISO/IEC 27001 | A.08.08 - Management of technical vulnerabilities | Mandates that information about technical vulnerabilities of information systems being used is obtained, the organization's exposure to such vulnerabilities is evaluated, and appropriate measures are taken. |
| CI/CD Pipeline Security | SonarCloud Security Configuration Gateways | Automated build rules and scanning reports proving code analysis checks run before new software increments are pushed to the platform. |
| Dependency Telemetry | GitHub Dependabot Automated Logging | Live system logs verifying daily execution parameters, dependency parsing, and alert-trigger tracking for package vulnerabilities. (Information Security Performance) |
| Runtime Infrastructure | Azure Security Center Vulnerability Dashboards | Real-time system exposure charts, infrastructure risk assessments, and compliance health logs. |
| Operational Controls | Periodic Security Controls | The continuous audit trail proving that technical checks are routinely reviewed, tracked, and verified through execution logs. |
Audit Summary
- Compliance Status: Fully Compliant
- Gaps Identified: None. Daily automated dependency scanning, pre-deployment code analysis, central cloud security posture tracking, and explicit, severity-based patch management timelines (SLAs) are fully operationalized within Annex A.8.8 and verified by periodic controls.