- Detect, prioritize, and remediate vulnerabilities on a defined cadence.
- Measure remediation effectiveness and repeatability.
- Discover vulnerabilities via scanning and advisories.
- Prioritize based on severity, exposure, and asset criticality.
- Remediate or accept risk with documented exceptions.
- Verify fixes and update evidence.
| Severity | Target remediation |
|---|---|
| Critical | 7 days |
| High | 14 days |
| Medium | 30 days |
| Low | 90 days |
- Incident response:
11-incident-response.md - Risk management:
09-risk-management.md