Requirements when building a vulnerability management program:

• Asset vulnerabilities are identified and documented.
• Threat and vulnerability information is received from information-sharing forums and sources.
• Newly identified vulnerabilities are mitigated or documented as accepted risks.
• A vulnerability management plan is developed and implemented.