The first step should be to define your process. There are different ways to do this, but in my experience, documents or slide decks are the most common. The description of your vulnerability management process may be part of a larger document or deck or broken down into different documents with their own maintainers, depending on your organizational needs. Regardless of the format, the document would answer questions like:
- What tools are used for vulnerability scans? What is the output of reports of each tool?
- How frequently are the tools updated with the latest vulnerability information?
- Are scans run continuously or at a cadence? If on a cadence, what cadence?
- For static scans, what code or environments are scanned?
- For dynamic scans, what environment is targeted? How close is this environment to production? How frequently is it updated?
- When a vulnerability is identified in a tool, how is it assessed or triaged? If it is determined to be a valid vulnerability in the system, how is it tracked to closure? If it is not a valid vulnerability, how is this documented?
Based on the answers to the question, you'll be able to figure out a lot of the other pieces.
The plan of storing reports in Google Drive with appropriate date organization does seem sufficient, but I'd want to look at ways to automate the process as much as possible. Can the vulnerability scanner store reports internally and you can export them on-demand? Do you trust the tool to do that? Can the vulnerability scanner integrate with defect tracking to record findings for triage? Can the vulnerability scanner be scheduled or triggered to run on certain events? Taking the human out of the loop as much as possible tends to let people focus on the things that people need to focus on rather than executing highly mechanical processes like downloading a report from a tool and uploading it to a repository.
If you're frequently fielding questions or audits from clients, you may want to consider if it makes sense to go after an ISO 27001 or SOC 2 audit. Their scope is much broader, but vulnerability management is a small piece of it. Having a third-party audit assess your process and review your objective evidence in order to get a certification or report that supports it could be something that you can just turn over to clients and reducing the complexity of their audits. They may accept the ISO 27001 certification or the SOC 2 report as sufficient and move on to other topics not covered.