Requirement
"Information about technical vulnerabilities of information systems in use shall be obtained, the organization’s exposure to such vulnerabilities shall be evaluated and appropriate measures shall be taken."[1]
Explanation
Identify vulnerabilities by performing vulnerability scans against the information system. Vulnerability scanners such as Nessus can be used to accomplish this. Document the vulnerabilities and address them in order of importance.
