2 docs tagged with "remediação"

Organisational policy that defines the requirements for the execution of offensive penetration tests (PenTesting), including scope and formal authorisation, test modalities, rules of engagement, minimum report content, the remediation and retest process, cadence by criticality level and integration with the findings process, proportionate to the criticality level (L1, L2, L3).

Remediation prioritisation layer based on the probability of exploitation (EPSS, FIRST.org) and confirmed exploitation (CISA KEV), applied on top of the CVSS-based patching SLAs. EPSS and KEV refine the order of remediation; the SLAs by severity remain as the mandatory floor.