Page Comparison

Practice Area

Checkpoint

Yes/No

Evidence - Comment

How to?

Security

Has the Release Security/Vulnerability table been updated in the   protected Security Vulnerabilities wiki space?

Table in in the protected Security Vulnerabilities wiki space   corresponding to the latest NexusIQ scan

PTL reviews the NexusIQ scans for their project repos and fills out   the vulnerability review table

Practice Area

Checkpoint

Yes/No

Evidence - Comment

How to?

Security

Has the Release Security/Vulnerability table been filled out in the   protected Security Vulnerabilities wiki space?

Table in in the protected Security Vulnerabilities wiki space   corresponds to the latest NexusIQ scan; all NexusIQ finding are marked as   false positive or exploitable with the supporting analysis.

PTL reviews the NexusIQ scans for their project repos and fills out   the vulnerability review table

Are all Defects of priority Highest and High in status   "Closed" in Jira? (this includes the Jira for Critical and Severe   NexusIQ findings)

All Jira tickets for vulnerability elimination are complete.

Complete Jira tickets

Did the project achieve the enablement of transport level encryption   on all interfaces?

All interfaces are exposed over TLS (or another secure protocol)

Provide   the "% Achieved" on the CII Best   Practices program.

Moved from Development section

Provide link to your project CII Best Practices page.

As documented in CII   Badging Program, teams have to fill out CII Best Practices

REMOVE FROM DEVELOPMENT

Is there any Critical and Severe level security   vulnerabilities older than 60 days old in the third party libraries used   within your project unaddressed?

Nexus-IQ classifies level as the following:

•   Critical is   level 7 to 10
•   Severe is   level 4 to 6
•   Moderate is   level 1 to 3

which is complaint with CVSS   V2.0 rating.