Trusted Partner Network (TPN) compliance

The Trusted Partner Network is a security initiative established by the Motion Picture Association (MPA). The TPN publishes the MPA Content Security Best Practices and registers compliant vendors as trusted partners. The TPN was established to improve security among vendors working in the entertainment industry and protect valuable content.

The MPA Best Practices v5.0 documentation describes the best practices and guidelines for vulnerability management. Specific to vulnerability scanning is control TS-25, which states:

Best Practices

Establish and regularly review a process and policy for Vulnerability Management, including vulnerability scans for both internal and external networks, cloud deployments, and virtual machines/containers, to include the following:

• For external IP ranges and hosts, perform scans monthly at a minimum
• For internal IP ranges and hosts, perform scans quarterly at a minimum
• Investigate and have a remediation plan for issues
• Perform a vulnerability scan after any major application or cloud infrastructure change
• Apply internal scan to WFH/remote worker endpoints where possible

Also scan the following if applicable:

• Production networks
• Non-Production networks
• Application Programming Interfaces (APIs)

Implementation Guidelines

Recommend implementing the following:

• Investigate and have a remediation plan for critical issues within 48 hours
• Authenticated and unauthenticated scanning
• Leverage Open Web Application Security Project (OWASP)