Update vulnerability risk factors

  * Verdict: If the secure update completes successfully, the most recently fixed vulnerability is fixed, and the documentation includes all the required information => PASS, otherwise FAIL

  * Evidence: Documentation of vulnerability handling, documentation of how to securely update the product, the report for the selected vulnerability, description of how to scan for the vulnerability, log of vulnerability scan results

> TODO: Add automatic update mitigation

#### 5.2.X.x **MI-SCAN**: No easily scannable exploitable vulnerabilities

If automatable and freely-usable vulnerability scanners are available for the product, then the product shall satisfy the following with respect to the three (or fewer, if fewer than three are avilable) most comprehensive of such scanners.

  * Evidence: Documented vulnerability handling policy, list of vulnerability scanners selected, reports from each scanner, correlation of reports of discovered vulnerabilities with documentation of mitigations

| Risk factors                                         | Requires mitigations |

|-------------------|----------------------|

| LOC < 1 & NET < 1 | KEVD                 |

|------------------------------------------------------|----------------------|

| max(LOC, NET, SYS, SDS, SDT, FUN, DOS) < 1           | none                 |

| max(LOC, NET, DOS) < 1 & max(SYS, SDS, SDT, FUN) = 1 | KEVD                 |

| all others                                           | KEVD, SCAN           |

| Security Profile | Requires mitigations |