PRC9 finding classes

Processing Protection

Is the compute that runs the business trustworthy and available?

The Processing domain covers the integrity and availability of compute: patch currency, workload and container hardening, build-pipeline trust, and resilience against disruption. It is where software supply chain and known-exploited vulnerabilities land.

What this domain covers

Patch currency, especially known-exploited vulnerabilities
Management, orchestration, and administrative interface exposure
Container, image, and workload hardening
Build pipeline and infrastructure-as-code integrity
Availability protection and rate limiting

Distribution across tiers

Tier 1 · Critical3 · 24–72 hours

Tier 2 · Regulatory3 · 30 days

Tier 3 · Best Practices3 · 90 days

Typically owned by Platform engineering / SRE.

Tier 1 · CriticalCould an external attacker use this to gain access, escalate privilege, or take data — today, without an insider and without a chain of unlikely events?

BCN-T1-PRC-00124 hours

Known-Exploited Vulnerabilities

Unpatched CVEs with confirmed exploitation in the wild, on systems an attacker can reach.

T1190T1203T1068

BCN-T1-PRC-00224 hours

Exposed Management and Orchestration Interfaces

Kubernetes dashboards, CI/CD consoles, hypervisor managers, or admin panels reachable from the internet.

T1133T1610T1552.007

BCN-T1-PRC-00348 hours

No Availability Protection on Revenue-Critical Services

Business-critical services with no rate limiting, no DDoS mitigation, and no capacity isolation.

T1498T1499

Tier 2 · RegulatoryWould a named auditor, regulator, or contractual counterparty record this as a deficiency?

BCN-T2-PRC-00130 days

Vulnerability Management Process Gaps

No defined scanning cadence, remediation SLA, or exception process — or incomplete asset coverage.

T1190

BCN-T2-PRC-00230 days

Change Management Control Gaps

Production changes without review, approval, testing, or a recorded rollback path.

T1195

BCN-T2-PRC-00330 days

Untested Incident Response Capability

No incident response plan, or a plan that has never been exercised.

T1486

Tier 3 · Best PracticesDoes fixing this reduce the number or severity of future Tier 1 and Tier 2 findings?

BCN-T3-PRC-00190 days

Container and Image Hardening

Containers running as root, from oversized base images, or without runtime constraints.

T1610T1611

BCN-T3-PRC-00290 days

CI/CD Pipeline Hardening

Build pipelines without dependency pinning, artefact signing, or runner isolation.

T1195.002T1552.004

BCN-T3-PRC-00390 days

Infrastructure-as-Code Security Gaps

Infrastructure defined in code without security scanning, policy enforcement, or drift detection.

T1578