Vulnerability Management Operating Pack — Guide
- Version 1.3
- Updated
- 9 documents
- Word, Excel, Online / Excel, PowerPoint
Vulnerability Management Pack
Your scanner reports hundreds or thousands of issues. Nobody agrees which ones matter, who should fix them, or by when. This pack gives you ready-made documents to settle those three questions and keep them settled.
Is this for you?
This pack is for you if:
- you have been made responsible for vulnerabilities, but security is not your only job;
- findings keep piling up and old ones never seem to get fixed;
- an auditor, regulator or customer is about to ask how you handle vulnerabilities.
You will need some way of scanning your systems. If you have none yet, start there.
Start with these three
You do not need all nine documents. Most teams get the biggest improvement from three:
- Risk Rating & Deadline Model — decides which findings to fix first and how long each may stay open. It looks at whether a weakness is being exploited or has public exploit code and whether the system faces the internet, not just the scanner’s severity label.
- Weekly Triage & Remediation Procedure — a 30-minute weekly routine: look at new urgent findings, give each one an owner, chase what is late.
- Remediation Tracker — one list of open findings with owner, deadline and status. A finding only counts as fixed when a new scan confirms it.
How the deadlines count. The clock starts on the earlier of the day the scanner first finds the weakness and the day the vendor published its fix. A finding the scanner meets a month after the vendor’s release has used up a month of its deadline, so fix what vendors release without waiting for the scan. Public exploit code for a High or Critical weakness on an internet-facing system makes it Priority 1, even when it is not on a list of exploited vulnerabilities. For a Medium or Low weakness it is a warning sign that can justify raising the priority.
Not sure where you stand? Take the free 15-minute self-assessment first. It tells you which documents will help most.
A simple 90-day plan
| When | What to do | You’re done when |
|---|---|---|
| Month 1 | Agree priorities and deadlines with IT. Give every group of systems a named owner. | IT and security accept the deadlines. |
| Month 2 | Run the weekly routine. Check which systems your scanner is missing. | The weekly meeting has run four times. |
| Month 3 | Get the rules approved by management and send your first short report. | Management has made a decision based on it. |
Everything in the pack
- Word
Vulnerability Management Standard
The rules management approves: what is scanned, how often, and the deadlines
- Word
Weekly Triage & Remediation Procedure
The weekly routine, step by step
- Word
Risk Rating & Deadline Model
How to decide what gets fixed first
- Excel
Scan Coverage Register
Shows which of your systems are not being scanned
- Excel
Remediation Tracker
Tracks each finding until it is confirmed fixed
- Excel
Scanner Set-up Checklist
Checks your scanner is giving you complete, trustworthy results
- Excel
Metrics Workbook
Four numbers management can act on, calculated for you
- Online / Excel
Self-Assessment
Scores your current approach and suggests next steps
- PowerPoint
Management Briefing Deck
Slides for your monthly or quarterly update
No document matches those words.
Adapting it
- Small team: the Standard asks for a weekly meeting, because the deadlines are short: a Priority 1 finding must be mitigated within 72 hours and fixed within 7 days, and 14 days is the tightest deadline for non-emergency findings, so a finding that waits two weeks to be discussed is already late. If you have few new findings, you can meet every two weeks instead: change the Standard to say so, and keep giving urgent findings an owner as soon as they appear. You can skip the slide deck at first.
- IT run by an outside provider: put the deadlines into your agreement with them, and ask for scan results, not just “done” updates.
- Regulated firm (banking, investment, payments): keep the scan coverage register up to date, because supervisors will ask which critical systems are covered.
Not covered here
Installing patches (Patch Management pack), penetration testing, handling a live attack (Incident Management pack), and choosing a scanning product. The documents also give no specific method for containers, images and short-lived cloud workloads, operational technology, the software supply chain (software bills of materials and third-party software intake), taking in vulnerability reports from outsiders, or finding assets nobody has listed. Add those to your own standard if they apply to you.