Vulnerability Management & Testing

Vulnerability management, testing, and remediation processes at FMIS

Vulnerability Management & Testing

FMIS applies a structured approach to identifying, assessing, and resolving security vulnerabilities across both development and hosted environments. This combines ongoing monitoring, automated scanning, and independent testing.

Approach

Vulnerability management is integrated into both system development and day-to-day operations.

Code is reviewed and scanned during development
Systems are monitored and assessed in production environments
Findings are logged, prioritised, and resolved through defined processes

This ensures that potential risks are identified early and managed consistently.

Code and system scanning

FMIS uses a combination of code-level and system-level scanning to detect vulnerabilities.

Code scanning identifies issues during development
System scanning validates the security of hosted environments
Findings are reviewed and addressed as part of controlled processes

Recent system-level scanning has confirmed that hosted environments are securely configured, with no outstanding critical issues following remediation.

FMIS Independent Code Testing and Penetration Testing

Independent testing

FMIS carries out regular independent testing to validate its security posture.

This includes annual infrastructure and application penetration testing (ITHC). Findings are reviewed and addressed through defined remediation processes.

This provides an external assessment of system security in addition to internal controls.

Remediation and tracking

All identified vulnerabilities are managed through a structured process.

Issues are logged and assessed based on severity
Remediation actions are defined and implemented
Updates are tested and verified before release

This ensures that vulnerabilities are addressed in a controlled and traceable way.

Continuous review

Vulnerability management is reviewed as part of the wider ISMS.

Results are reviewed during internal audits and management reviews
Processes are updated based on findings and evolving risks
Security controls are refined over time

This supports ongoing improvement rather than one-off remediation.

Further information

If you require additional detail on vulnerability management or testing processes, please contact:

privacy@fmis.co.uk

Vulnerability Management & Testing