Lesson 2.45: Vulnerability SLAs: measuring remediation
Finding vulnerabilities is easy; fixing them on time across hundreds of systems is the hard part. A remediation standard sets deadlines by severity (service level agreements, SLAs), an exception process covers the cases that can't meet them, and the programme is measured on how many fixes happen within those deadlines. In the lab you read Northwind's standard, find what's overdue, check that the exceptions people point to are real, group open findings by age and compute the SLA compliance rate for the quarter.
17 min
You will learn to
- Read a remediation standard with SLAs by severity
- Find overdue findings
- Verify exceptions against the exception register
- Build ageing buckets
- Compute SLA compliance for closed findings
Key terms
- SLA
- Service level agreement: here, the maximum days to fix a finding of a given severity.
- Exception
- Approved, time-limited permission to miss an SLA, with a compensating control.
- Compensating control
- A different control that reduces the risk while the main fix waits.
- Ageing bucket
- A range of days open used to show the long tail of findings.
- SLA compliance
- The share of findings fixed within their deadline.
← Mapping controls to NIST CSF 2.0 · All lessons · Security operating model and managed providers →