Technical Vulnerability & Threat Management Policy¶
Purpose. Ensure vulnerabilities in Soon's product and infrastructure are found and fixed within defined timescales, and that relevant threat information is monitored and acted on. Absorbs threat intelligence requirements (A.5.7).
1. Scope¶
Soon's product code, dependencies, container images, and AWS infrastructure. Endpoint patching is covered by the Endpoint Protection Policy.
2. Policy¶
2.1 Identifying vulnerabilities¶
- Dependency and container-image scanning must run on product repositories via GitHub. TODO(owner): confirm exact scanning setup (Dependabot, container scanning).
- Shared responsibility: AWS is responsible for vulnerabilities in the underlying cloud (hardware, hypervisor, managed-service patching); Soon is responsible for its own code, dependencies, images, and configuration.
- A penetration test of the SaaS product must be performed periodically. TODO(owner): confirm cadence and vendor.
- Security researchers can report vulnerabilities to Soon. The coordinated-disclosure contact is security@soon.works (see security@soon.works) and publish it.
2.2 Remediation SLAs¶
Vulnerabilities are triaged by severity (CVSS or scanner rating) and must be remediated within:
| Severity | Deadline |
|---|---|
| Critical | 7 days |
| High | 30 days |
| Medium | 90 days |
| Low | next regular release cycle |
These SLAs are confirmed by the owner (2026-08-13) and are the standard Soon is measured against. If a fix cannot meet the SLA, the security responsible must record a risk-based exception with a target date and report it at management review.
- Exploited-in-the-wild vulnerabilities in internet-facing components must be treated as critical regardless of score.
2.3 Threat intelligence¶
- Monitored sources: AWS security bulletins, advisories from vendors in Soon's stack (GitHub, Netlify, framework maintainers), and national CERT feeds (e.g. NCSC/CISA). TODO(owner): confirm which sources are actually followed and how (mail subscriptions, RSS).
- The security responsible reviews relevant advisories, assesses applicability to Soon's stack, and triggers patching (2.2) or a risk-register update where needed.
- Significant threats affecting customers are communicated per the Incident Response process.
3. Roles & responsibilities¶
- Security responsible: monitors sources, triages alerts, tracks SLAs, owns exceptions, arranges pentests.
- Engineers: remediate assigned vulnerabilities within SLA via the normal PR/CI process.
4. Related documents¶
- Secure Development Policy
- Endpoint Protection Policy
- Change Management Process
- Information Security Event Reporting Procedure
Change log¶
| Version | Date | Author | Comments |
|---|---|---|---|
| 0.1 | 2023-10-23 | Olaf Jacobson | First draft document |
| 0.2 | 2026-07-18 | Andrea Cardinali | Rewritten lean and Soon-specific (ISMS overhaul); absorbs threat intelligence (A.5.7) |