Vulnerability remediation SLAs define mandatory timeframes for patching or mitigating identified vulnerabilities based on severity, asset criticality, and exploit availability. Effective SLA programs
Vulnerability remediation SLAs define mandatory timeframes for patching or mitigating identified vulnerabilities based on severity, asset criticality, and exploit availability. Effective SLA programs drive accountability, ensure consistent remediation timelines, and provide measurable KPIs for vulnerability management maturity.
| Severity | Tier 1 (Critical) | Tier 2 (Important) | Tier 3 (Standard) |
|---|---|---|---|
| Critical (CVSS 9.0-10.0) | 24-48 hours | 72 hours | 7 days |
| High (CVSS 7.0-8.9) | 7 days | 14 days | 30 days |
| Medium (CVSS 4.0-6.9) | 30 days | 45 days | 60 days |
| Low (CVSS 0.1-3.9) | 90 days | 90 days | 90 days |
| CISA KEV Listed | 24 hours | 48 hours | 7 days |
Tier 1 (Critical Assets):
- Customer-facing production systems
- Payment processing infrastructure
- Domain controllers and identity systems
- Core network infrastructure (firewalls, routers)
- Databases containing PII/PHI/PCI data
Tier 2 (Important Assets):
- Internal production applications
- Email and collaboration systems
- Development/staging environments with production data
- Backup and recovery infrastructure
- VPN and remote access gateways
Tier 3 (Standard Assets):
- End-user workstations
- Development/test environments
- Print servers and peripheral management
- Non-critical internal tools
Key sections to include:
# ServiceNow / Jira integration for automatic ticket creation
# See process.py for full implementation
# Key fields for remediation tickets:
# - Vulnerability ID (CVE/Plugin ID)
# - Affected host(s)
# - Severity (CVSS + contextual factors)
# - Asset tier
# - SLA deadline (calculated from discovery date)
# - Assignment group
# - Remediation instructions
# - Verification criteria
SLA Status Action Notify
───────────────────────────────────────────────────────────
75% elapsed Warning email Asset owner
100% elapsed SLA breach notification Manager + CISO
100% + 7 days Executive escalation VP/CTO
100% + 30 days Risk acceptance required CISO approval
100% + 90 days Compensating controls mandatory Board report
Valid exception reasons:
Exception requirements:
| KPI | Definition | Target |
|---|---|---|
| SLA Compliance Rate | % of vulns remediated within SLA | >90% |
| Mean Time to Remediate (MTTR) | Average days from discovery to fix | Critical: <3d, High: <10d |
| Vulnerability Backlog | Open vulnerabilities past SLA | <5% of total |
| Exception Rate | % of findings with active exceptions | <10% |
| Recurrence Rate | % of vulns that reappear after remediation | <5% |