Design a vulnerability remediation SLA program covering asset tiering, a severity-based SLA matrix, exception processes, escalation chains, ticketing-system integration, and remediation KPIs/trending metrics. Use when defining mandatory patching timeframes by severity and asset criticality, building an SLA policy document, or setting up escalation and KPI tracking for vulnerability remediation.
Start a fresh conversation. Replace the highlighted placeholders.
Use implementing-vulnerability-remediation-sla to design a vulnerability-remediation SLA policy for [asset tiers, vulnerability-scanning and ticketing context, and governance stakeholders], including severity and asset-based deadlines, exploit-context accelerators, exception approvals, breach escalations, and KPI reporting.
Required inputs
[asset tiers, vulnerability-scanning and ticketing context, and governance stakeholders]
User-approved starter prompt based on a pinned source version; check current skill requirements before running. Task evidence ↗
SKILL.md
name: implementing-vulnerability-remediation-sladescription: Design a vulnerability remediation SLA program covering asset tiering, a severity-based SLA matrix, exception processes, escalation chains, ticketing-system integration, and remediation KPIs/trending metrics. Use when defining mandatory patching timeframes by severity and asset criticality, building an SLA policy document, or setting up escalation and KPI tracking for vulnerability remediation.domain: cybersecuritysubdomain: vulnerability-managementtags: - vulnerability-management- cve- sla- remediation- patch-management- riskversion: '1.0'author: mahipallicense: Apache-2.0nist_csf: - ID.RA-01- ID.RA-02- ID.IM-02- ID.RA-06mitre_attack: - T1190- T1203- T1068
Implementing Vulnerability Remediation SLA
Overview
Vulnerability remediation SLAs define mandatory timeframes for patching or mitigating identified vulnerabilities based on severity, asset criticality, and exploit availability. Effective SLA programs drive accountability, ensure consistent remediation timelines, and provide measurable KPIs for vulnerability management maturity.
When to Use
When deploying or configuring implementing vulnerability remediation sla capabilities in your environment
When establishing security controls aligned to compliance requirements
When building or improving security architecture for this domain
When conducting security assessments that require this implementation
Prerequisites
Vulnerability scanning program producing regular findings
Asset inventory with criticality classifications
Ticketing system (Jira, ServiceNow, etc.) for remediation tracking
Executive sponsorship for SLA enforcement
Cross-functional agreement from IT operations, development, and security
Core Concepts
SLA Framework Components
Severity Classification: CVSS base score + threat context (EPSS, KEV)
Asset Tiering: Business criticality and exposure level
Remediation Timeframes: Maximum days to remediate by category
Exception Process: Documented approval for SLA extensions
Escalation Procedures: Actions when SLAs are breached
Metrics and Reporting: KPIs for compliance tracking
Recommended SLA Matrix
Severity
Tier 1 (Critical)
Tier 2 (Important)
Tier 3 (Standard)
Critical (CVSS 9.0-10.0)
24-48 hours
72 hours
7 days
High (CVSS 7.0-8.9)
7 days
14 days
30 days
Medium (CVSS 4.0-6.9)
30 days
45 days
60 days
Low (CVSS 0.1-3.9)
90 days
90 days
90 days
CISA KEV Listed
24 hours
48 hours
7 days
SLA Accelerators (Reduce SLA by 50%)
Exploit code publicly available
Active exploitation observed in the wild (CISA KEV)
Internet-facing asset affected
EPSS score > 0.5 (50% exploitation probability)
Previous breach via similar vulnerability type
Workflow
Step 1: Define Asset Tiers
Tier 1 (Critical Assets):
- Customer-facing production systems
- Payment processing infrastructure
- Domain controllers and identity systems
- Core network infrastructure (firewalls, routers)
- Databases containing PII/PHI/PCI data
Tier 2 (Important Assets):
- Internal production applications
- Email and collaboration systems
- Development/staging environments with production data
- Backup and recovery infrastructure
- VPN and remote access gateways
Tier 3 (Standard Assets):
- End-user workstations
- Development/test environments
- Print servers and peripheral management
- Non-critical internal tools
Step 2: Establish SLA Policy Document
Key sections to include:
Purpose and scope
Roles and responsibilities (RACI matrix)
Severity definitions and calculation method
Remediation timeframes by severity and asset tier
Exception request process and approval authority
Escalation procedures for SLA breaches
Metrics, reporting cadence, and governance
Policy review and update schedule
Step 3: Integrate with Ticketing System
# ServiceNow / Jira integration for automatic ticket creation
# See process.py for full implementation
# Key fields for remediation tickets:
# - Vulnerability ID (CVE/Plugin ID)
# - Affected host(s)
# - Severity (CVSS + contextual factors)
# - Asset tier
# - SLA deadline (calculated from discovery date)
# - Assignment group
# - Remediation instructions
# - Verification criteria