Vulnerability patching SLA

Control Design Assessment (CDA)

Procedures evaluating whether the control is designed adequately.

1. 1.Confirm the vulnerability management standard defines the 14-day critical patch SLA and the authoritative severity source.ID.RA-01
2. 2.Confirm critical vulnerabilities are identified from a complete asset inventory.ID.AM-01

Control Operating Effectiveness (COE)

Procedures evaluating whether the control operated over the testing period.

1. 1.Select 25 critical vulnerabilities disclosed in the period and confirm remediation within 14 days.
2. 2.For exceptions, confirm a documented risk acceptance with an approved compensating control.GV.RM-01
3. 3.Confirm reopened or recurring vulnerabilities were escalated.

Linked risks

• Ransomware disruptionmitigation 2
• Third-party software vulnerabilitymitigation 3

Framework mappings & latest test