Building CVE Tracking: Start Today

You probably aren't tracking CVEs for your building's IoT devices.

Most organizations don't. It's complex, time-consuming, requires expertise.

But here's what you should be asking:

"Is a critical vulnerability affecting my HVAC controller? My access control sensor? My energy management system?"

If you don't know the answer, you're operating blind.

SBCGA-DISCLOSE starts simple:

1. Inventory your devices

2. Subscribe to CVE feeds for those devices (NIST NVD, vendor advisories)

3. Create a simple vulnerability register

4. When CVEs are announced, assess impact on YOUR devices

5. Determine if patching is feasible

This is governance, not rocket science.

Week 1: Know what you have

Week 2: Set up CVE notifications

Month 1: Create your first vulnerability register

Month 2+: Maintain it and use it

Your building's security depends on knowing what's vulnerable and managing it systematically.

Start with an audit. Know what you have. Then build from there.

AC-146 + SBCGA will show you how.

Recent Posts