How CIPPlanner identifies, assesses, remediates, and communicates software security vulnerabilities in CIPAce™.
Published: October 25, 2025
At CIPPlanner, the security of our clients’ applications and data is our highest priority. This Security Incident Response Operating Procedure outlines how CIPPlanner identifies, assesses, remediates, and communicates software security vulnerabilities. The procedure has been developed and executed in response to security vulnerabilities reported by CIPPlanner through MITRE to the Common Vulnerabilities and Exposures (CVE) database.
The primary objective of CIPPlanner’s Security Incident Response Operating Procedure is to minimize the impact of security incidents, contain identified threats, and restore normal operations as quickly and safely as possible.
CIPPlanner recognizes its fiduciary responsibility to:
To support transparency and responsible disclosure, CIPPlanner registers discovered software vulnerabilities in the Common Vulnerabilities and Exposures (CVE) database. This ensures that identified risks are documented, traceable, and accessible to both clients and the broader cybersecurity community.
While vulnerability management is critical, CIPPlanner acknowledges that cybersecurity risk management also encompasses broader considerations, including policies, best practices, and organizational capacity-building, particularly as it relates to human resources and operational readiness.
CIPPlanner follows an eight-step, iterative process to achieve enterprise-wide cybersecurity objectives and continuously strengthen platform security.
Upon discovery of a software vulnerability, CIPPlanner initiates a collaborative assessment process involving cross-functional and inter-departmental teams to clarify and evaluate the issue.
This assessment includes analysis of:
During this phase, CIPPlanner evaluates potential contributing factors, including whether vulnerabilities stem from opportunities to enhance development methodologies or engineering practices.
With a comprehensive understanding of identified vulnerabilities, CIPPlanner develops remediation strategies on a customer-by-customer and installation-by-installation basis.
Planning considerations include:
This ensures remediation efforts align with each customer’s technical and operational environment.
Discovered vulnerabilities are formally registered in the CVE database, which assigns a unique identifier to known security vulnerabilities in publicly released software.
CIPPlanner’s CVE submission process includes:
Important Note:CVE submissions do not include customer-identifying information. Vulnerabilities are initially submitted under a Private status, allowing CIPPlanner to plan and deploy remediation efforts before public disclosure. Submissions may be updated as new information becomes available.
Where appropriate, research may extend to regulatory environments, infrastructure and IT sectors, and other authoritative resources to enhance remediation efforts and contribute to broader cybersecurity awareness.
This phase focuses on developing effective remediations for identified vulnerabilities, which may include:
CIPPlanner’s technical teams develop, test, and validate remediations across affected CIPAce™ codebases to ensure effectiveness and stability.
CIPPlanner deploys tested remediations in a controlled and orderly manner across applicable environments.
Deployment considerations include:
For customers opting to manage installations independently, CIPPlanner provides secure download links, patch details, and system requirements. CIPPlanner collaborates with customers to monitor successful implementation and resolution.
CIPPlanner is committed to transparent communication with customers, partners, regulatory bodies, and other stakeholders.
After confirming that all outstanding customer production environments are secured, CIPPlanner:
Important Note:Public disclosure does not occur until all known customer safety concerns have been addressed.
CIPPlanner continuously evaluates and strengthens its cybersecurity posture through:
These efforts support proactive and reactive cybersecurity resilience across the platform.
The final step focuses on learning and continuous improvement.
Activities include:
Insights gained during this phase inform future incident response planning and platform enhancements.
For questions related to this policy or CIPPlanner’s security practices, please contact:
CNAs (CVE Numbering Authorities) are vendor, researcher, open source, CERT, hosted service, bug bounty provider, and consortium organizations authorized by the CVE Program to assign CVE IDs to vulnerabilities. For further information on CVE, please visit CVE Website.
To report a suspected vulnerability or security event in CIPAce™, email EventReport@cipplanner.com. Published notifications of resolution are listed on the Security and Compliance page.
