Independent thinking. Informed defence.

CISO Times

Intelligence for the people behind the defence.

The CISO Decision Brief

If…, then how…

If the scanner reports a critical finding on a system nobody owns, then who fixes it?

6 decision pointsThe pack behind this answer: Vulnerability & Exposure Management

Add to board memo

The short answer

Recommendation
The owner of your vulnerability standard assigns an owner straight away, because the finding's deadline is already running. Until then, rate the finding as if the system were internet-facing and Critical, and start the emergency route at once if it is being exploited.
Reasoning
An ownerless finding is two problems: the weakness and a gap in the asset inventory. The weakness cannot wait for the gap to close. The deadline counts from the day the scanner first found it, so time spent finding an owner comes out of it. Unknown exposure and criticality take the more urgent values, so gaps cost the people who can close them. A provider may run the system, but the owner is still a person in your organisation. If nobody needs the system, retiring it fixes the weakness for good.
Considerations
  • The roles, timings and deadlines are the defaults in the CISO Times vulnerability pack. Your own standard may name different roles and set different times.
  • Unknown exploitation is treated as not known exploited and checked again at the next weekly triage. Unknown exposure and criticality take the more urgent value.
  • An ownership dispute not settled at triage goes to the standard owner, who decides within 2 working days in the pack's default. The deadline does not pause meanwhile.
  • If you cannot tell whether anyone depends on the system, assume someone does. Switching off something that matters is its own incident.

The decision, step by step

Select any step for the reasoning behind it and where the pack covers it.

  • Start
  • Step
  • Decision
  • Outcome
StartA critical finding on a system nobody ownsStepRate it, treating unknowns as the more urgent valueDecisionIs it being exploited, making it Priority 1?StepStart the Priority 1 route now, before the owner is settledDecisionIs the system in your asset inventory at all?StepAdd it to the inventory, and find out what it doesDecisionDoes a service provider run it for you?StepName an internal owner; the provider fixes under its contractDecisionDoes anyone use or depend on it?OutcomeAssign someone to retire it, then close on the retirement recordStepThe standard owner assigns an ownerDecisionDoes the person named accept ownership?OutcomeThe standard owner decides, and the decision standsStepCorrect the inventory the same weekDecisionCan the owner fix it by the deadline?OutcomeFixed, confirmed by a rescanOutcomeThe owner requests an exception before the deadline

Keyboard: Tab to a step, arrow keys move along the flow, Enter pins its explanation, + and − zoom, 0 fits the diagram, Esc closes. The text version below has the same content.

Where a step quotes a number, it is the default in the CISO Times pack. Your own standard may set a different one.

Read as text

The same flow written out: each step, its reasoning and where the pack covers it. 17 steps.

  1. Start

    A critical finding on a system nobody owns

    The pack's standard requires every system in scope to be in the asset inventory with an owner. An ownerless finding is therefore two problems: the weakness, and a gap in the inventory. The weakness cannot wait for the gap to be closed.

    In the pack

  2. Step

    Rate it, treating unknowns as the more urgent value

    An ownerless system usually has no recorded exposure or criticality either. Treat unknown exposure as internet-facing and unknown criticality as Critical until someone shows otherwise. The deadline counts from the day the scanner first found it, and time spent finding an owner comes out of it.

    In the pack

    See also

  3. Decision

    Is it being exploited, making it Priority 1?

    Exploited means reliable evidence of real attacks, such as a listing in the CISA Known Exploited Vulnerabilities catalogue. While exposure and criticality are defaulted to the urgent values, any exploited finding here comes out as Priority 1. If you don't know, the pack treats it as not exploited and checks again at the next weekly triage.

    In the pack

  4. Step

    Start the Priority 1 route now, before the owner is settled

    Notify the standard owner immediately and open a Priority 1 ticket. The standard owner names someone to apply a compensating control within 72 hours, in the pack's defaults, such as blocking access, disabling the feature or isolating the system. The formal owner can follow. A Priority 1 still without a control at 72 hours goes to the approver and the incident process.

    In the pack

    See also

  5. Decision

    Is the system in your asset inventory at all?

    It may be listed with the owner field blank, or the owner may have left. It may not be listed at all, which means something went into service without being registered. Check by address, host name and cloud account.

    In the pack

  6. Step

    Add it to the inventory, and find out what it does

    Give it an entry now, even with gaps. Look at what it runs, who connects to it, and which cost centre or cloud account pays for it. The pack's standard expects new systems in scanning scope within 5 working days of going live. A system the scanner found first shows that check was missed.

    In the pack

    See also

  7. Decision

    Does a service provider run it for you?

    Hosting and ownership are different things. A provider may operate the system while someone in your organisation relies on it and answers for it. Check your contracts and supplier list. If you still don't know, treat it as yours to fix.

    In the pack

  8. Step

    Name an internal owner; the provider fixes under its contract

    The provider fixes vulnerabilities in systems it operates within the contractual deadlines, and supplies evidence. The asset owner is still a named person in your organisation, never the provider. If the provider misses its deadline, escalate to your supplier or contract manager under the service agreement.

    In the pack

    See also

  9. Decision

    Does anyone use or depend on it?

    Look for users, connections and data flows. An unowned system is often a leftover from a finished project or a departed team. If you cannot tell, answer yes: switching off something that turns out to matter is its own incident.

  10. Outcome

    Assign someone to retire it, then close on the retirement record

    Removing the system fixes the weakness for good, but someone still has to own the switch-off. The standard owner assigns them. The finding closes on the updated inventory and the retirement or change record, once the system no longer answers scans. Its absence from one scan is not enough.

    In the pack

  11. Step

    The standard owner assigns an owner

    In the pack, the owner is whoever the asset inventory names. If none is recorded, the standard owner assigns one. A sensible choice is someone with the authority and the budget to fix or replace the system, such as the manager of the service it supports. Every Priority 1 to 3 finding has a named owner before the triage meeting ends, and a Priority 2 gets one within 2 working days of detection.

    In the pack

  12. Decision

    Does the person named accept ownership?

    Owners who dispute ownership say so at the triage meeting. Disputes over ownership are the most common reason findings go unfixed, so settle them quickly and do not reopen them each week.

    In the pack

  13. Outcome

    The standard owner decides, and the decision stands

    A dispute not settled in the meeting goes to the standard owner, who decides within 2 working days in the pack's defaults. The deadline does not pause while they decide. If the dispute is really about capacity, the escalation route for late findings exists to move it to a manager who can free up time.

    In the pack

  14. Step

    Correct the inventory the same week

    Record the owner, the system's criticality and whether it is internet-facing. The pack allows 5 working days to correct a criticality that was defaulted. Once the real values are in, re-read the priority. The deadline still counts from first detection.

    In the pack

  15. Decision

    Can the owner fix it by the deadline?

    A new owner inherits a deadline that has already been running. If it cannot be met, the owner requests an exception before it passes. If it is missed with no exception, it is reported as overdue and escalated to the owner's manager.

    In the pack

  16. Outcome

    Fixed, confirmed by a rescan

    The finding closes when a later scan no longer reports it, or other objective evidence shows the fixed state. The person who fixed it should not be the only one who confirms it.

    In the pack

    See also

  17. Outcome

    The owner requests an exception before the deadline

    An exception names a risk owner, the compensating controls and an expiry, and is decided by the right approver. The newly named owner is the one who asks, which is one more reason to settle ownership first.

    In the pack

    See also

Practical checklist

  1. Rate the finding with unknown exposure as internet-facing and unknown criticality as Critical.
  2. If it is being exploited, notify the standard owner and have someone apply a compensating control within 72 hours.
  3. Find the system in the asset inventory, or add it now and find out what it does.
  4. Check whether a service provider runs it. If so, name an internal owner and hold the provider to its contract.
  5. Have the standard owner assign an owner with the authority and budget to fix or replace it, or someone to retire it.
  6. Correct the inventory the same week and re-read the priority, keeping the first-detection date.
  7. Have the owner fix it by the deadline, or request an exception before the deadline passes.

Evidence to have ready

  • The finding's first-detection date, its inputs, which were defaulted, and its priority and deadline.
  • The inventory entry showing the owner, criticality and exposure, and when they were corrected.
  • The standard owner's assignment, and their decision on any ownership dispute.
  • The closing evidence: a rescan confirmed by someone other than the fixer, a retirement record, or an approved exception.

Assumptions

  • 'Critical' here means the scanner's severity rating. The system's own criticality may be unknown.
  • The roles, timings and deadlines shown are the defaults in the CISO Times vulnerability pack. Your own standard may name different roles and set different times.

Not covered here