Jump to a page or a control
Identify · Established tier · Infrastructure Security
Regular scans find vulnerabilities, and critical findings on exposed assets are fixed within the bank's 15-day standard.
Status
Partial evidence1 item only partly supports it.
Exposure
High
2 evidence items from 2 sources
CCSA · Identify
Below FoundationalNot blocking this domain's next tier.
Internet-facing criticals close in a median of 21 days against the 15-day standard; 6 are open beyond it.
Remediation · Infrastructure Security
Add an emergency patch window for internet-facing criticals and escalate the 6 overdue findings.
Root cause: Patch window. Internet-facing criticals wait for the monthly window.
Every item is read-only, dated, hashed and re-runnable. This is what an examiner can test.
ev-id02-1
Internet-facing criticals close in a median of 21 days (standard: 15)
Tenable Vulnerability Management · telemetry · collected 9 h ago (Oct 15, 2026 · 04:59 UTC) · limit 48 h
Powered by Mesh APIGET /workbenches/vulnerabilities?severity=critical&tag.exposure=internet5ac313697e2163e4cf7e892232fe03b2d4e32810bf85e406c2bbc6789ac9fdf4
ev-id02-2
Endpoint criticals close in a median of 9 days
CrowdStrike Falcon · telemetry · collected 1 h ago (Oct 15, 2026 · 12:59 UTC) · limit 48 h
GET /spotlight/combined/vulnerabilities/v1?filter=cve.severity:'CRITICAL'61233f9f2b5f2d1552ab735051c724fb21a3851f738b0c0057454e9465042313