Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteSet vulnerability remediation deadlines using both threat evidence and the importance and exposure of the affected asset—not a CVSS score alone. A useful SLA policy defines risk bands, starts the clock at a clear event, assigns an accountable owner, tracks temporary mitigations separately, and requires evidence before a finding is closed. CISA’s binding risk-based deadlines apply to federal civilian executive branch agencies; other organizations can use its Known Exploited Vulnerabilities (KEV) catalog as a prioritization signal while setting deadlines that fit their own obligations and capacity.
What should determine a remediation deadline?
CVSS is useful for describing a vulnerability’s technical severity, but it does not by itself establish the risk to a particular organization. A flaw on an internet-facing system that holds critical data may warrant faster action than a similar-scoring flaw on an isolated, low-impact asset. Conversely, confirmed exploitation can make a vulnerability urgent even when its base score does not look exceptional.
As an Amazon Associate I earn from qualifying purchases.
For each finding, assess the following factors together:
- Exploitation evidence: Is the vulnerability listed in CISA’s KEV catalog, or is there other credible evidence that attackers are exploiting it?
- Exposure and reachability: Is the affected asset publicly accessible, reachable from an untrusted network, or otherwise exposed to likely attackers?
- Exploitability: Is exploitation automatable? Is working exploit code available, and how much access or interaction would an attacker need?
- Potential impact: Could exploitation cause partial or total control, expose sensitive data, interrupt a critical service, or enable further compromise?
- Asset context and defenses: How important is the affected service? Are effective compensating controls already in place, and is a vendor fix available?
- Confidence and detection: How reliable is the finding, and can the organization detect attempted exploitation or verify that controls are working?
FedRAMP’s 2026 rules require covered providers to adjust risk and severity using contextual factors including criticality, reachability, exploitability, detectability, prevalence, and mitigation, alongside CVSS base scores where applicable. That is a useful policy-design model for other organizations, but those requirements apply in the FedRAMP context.
#1 Best Overall
Build risk bands that lead to clear deadlines
The following is an illustrative internal policy starting point, not an industry standard, legal requirement, or CISA schedule for private organizations. Set and approve your own targets after checking regulatory, contractual, customer, and operational requirements. The example uses calendar days from validation of the finding; define a different clock if your organization needs one, and do not silently switch between calendar and business days.
| Risk band | Typical indicators | Illustrative remediation target | What to do if the target cannot be met |
|---|---|---|---|
| Urgent | Confirmed active exploitation or KEV listing combined with public exposure, high-impact service, or a credible path to serious compromise. | Within 3 calendar days of validation. | Apply and validate an interim mitigation immediately, escalate to the security leader and accountable business owner, and document a time-limited exception if remediation remains overdue. |
| High | Exposed or business-critical asset with a practical exploit path and substantial potential impact, even without confirmed exploitation. | Within 14 calendar days of validation. | Reduce exposure or restrict access while the fix is prepared; record residual risk and an exception expiry if the deadline must move. |
| Moderate | Exploitable weakness with limited reachability, meaningful controls, or a more contained likely impact. | Within 30 calendar days of validation. | Keep the finding assigned and monitored; document why the control is effective and when it will be reviewed. |
| Low | Limited practical exploitability and impact on a low-criticality, well-controlled asset. | Within 90 calendar days of validation. | Schedule the fix in a tracked maintenance window and reassess if exposure, exploitation evidence, or asset importance changes. |
These bands should be rules, not labels applied by intuition. Define what evidence qualifies for each factor and who can resolve disputed classifications. A known-exploited, internet-facing flaw should not be pushed into a slower band solely because its CVSS score is lower than a numerical threshold. Likewise, a high CVSS score should trigger review, not automatically dictate the same deadline for every asset.
CISA’s Binding Operational Directive 26-04, issued June 10, 2026, demonstrates why a single universal day count is misleading. For federal civilian executive branch agencies, it sets asset-by-asset remediation timelines using public exposure, KEV status, exploit automation, and whether technical impact is partial or total. CISA’s implementation guidance gives a conditional example: a vulnerability that CISA determines is on a publicly exposed asset, has total technical impact, and is automatable has a three-day KEV patching deadline under the federal scheme. That example is not a general private-sector SLA.
Set the clock, scope, and ownership
A deadline only works if people can tell what it applies to and when it begins. Put these decisions in the written policy:
- Scope: Name the covered environments, asset classes, cloud services, applications, dependencies, and business units. Identify any assets governed by a separate regulatory or contractual timetable.
- Clock basis: State whether targets use calendar or business days and whether the clock starts at discovery, validation, vendor notification, or another defined event. For a sample policy, validation is a practical start because it makes the finding actionable; urgent active exploitation may justify starting earlier.
- Assignment: Name the remediation owner and the business or service owner for each affected asset. Define who can change a risk band and who receives overdue escalations.
- Required records: Capture the vulnerability identifier, affected asset, owner, exposure, KEV or other exploitation status, relevant CVSS score and vector, exploitability, business impact, vendor-fix status, controls, due date, and verification evidence.
- Precedence: Explain how the policy handles stricter external requirements and how exceptions are approved without erasing the finding from reports.
Apply the classification to each affected asset rather than assuming one CVE has the same risk everywhere. The same software flaw can have different exposure, business impact, and controls across production, development, and isolated systems.
Keep mitigation separate from remediation
A mitigation can reduce risk before a permanent fix is ready, but it does not necessarily eliminate the vulnerability. FedRAMP’s 2026 rules distinguish mitigation, which reduces risk or impact, from remediation, which entirely eliminates the vulnerability. CISA’s federal response model includes patching, decommissioning, or another action that removes the vulnerable condition as remediation.
Rank #3
If a patch cannot be deployed by the target, record the temporary measure separately from the remediation status. Examples include restricting network access or disabling an affected feature, where appropriate. For each measure, document:
Recommended Free Tools
- What changed, who implemented it, and which assets it covers.
- How and when the control was validated, including any monitoring needed to detect bypass or failure.
- The remaining risk, the person accepting it, and a review or expiry date.
- The permanent fix plan and the date by which the finding must be reassessed.
Keep the vulnerability open until it has been eliminated and closure is verified. A temporary control should not reset the remediation clock or turn an overdue finding into a closed one.
Govern exceptions and verify closure
An exception records accepted risk; it is not a substitute for assigning and tracking remediation. Require a named risk owner, a specific business reason, compensating controls, an expiry date, and periodic reapproval. Escalate overdue KEV findings and confirmed active exploitation to security leadership under a defined process. Reopen or reclassify a finding if exposure increases, a mitigation stops working, or new exploitation evidence appears.
Before closure, require evidence appropriate to the fix. This could be a successful patch or version check, a clean authenticated rescan, a validated configuration change, or documentation that the vulnerable asset was decommissioned. Record who checked it and when. A ticket marked “done” without verification does not establish that the risk has been removed.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Measure whether the policy is working
Review results by risk band, asset group, and responsible team rather than relying on a single enterprise-wide average. Useful measures include:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
- Percentage of findings remediated and verified within their target.
- Overdue count and age, with separate views for KEV and actively exploited findings.
- Time spent under temporary mitigation and the number of expired exceptions.
- Repeat exceptions, reopened findings, and the rate of verified closure.
- Backlog and age by risk band, including assets whose owner or exposure is unknown.
Use the results to adjust staffing, maintenance windows, risk thresholds, and escalation paths—not to lower deadlines simply to improve a compliance percentage. CISA reports median time to remediate or mitigate valid reports in its vulnerability-disclosure reporting context; that is an example metric for that program, not a universal patch-SLA mandate. Asset inventory and vulnerability-management tools can help correlate ownership, exposure, KEV status, due dates, exceptions, and verification evidence, but the risk rules and accountability still need to be defined by the organization.
Best Value
Know which guidance applies to your organization
CISA BOD 26-04 is a binding directive for federal civilian executive branch agencies, and it supersedes BOD 19-02 and BOD 22-01. Its federal deadlines should not be presented as rules for every business. CISA nevertheless recommends that all organizations monitor its KEV catalog and prioritize listed vulnerabilities; for organizations outside the directive’s scope, KEV is an important input to their own policies, not a universal prescribed number of days.
When setting a non-federal SLA, map applicable regulations, contracts, customer commitments, and internal risk appetite first. The available primary guidance establishes no single universal remediation deadline table for all private-sector organizations. Use a documented, contextual model and make the chosen deadlines achievable, finite, and enforceable.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
