Vulnerability Programme Maturity Self-Assessment

Scores an existing programme across eight dimensions and returns the three highest-value next actions rather than a bare maturity number.

Available soon

Answer it online instead: How mature is our vulnerability management?About 15 minutes, free, and nothing is stored.

Format: Excel
Size: 66 KB
Length: 11 sheets
Version: 1.0
Updated: 27 Sep 2026

What's inside

Instructions
Questions
Dimensions & Weights
Results
Export
Lists
Definitions
Framework References

Preview

The workbook's sheets as you will receive them, with its example rows and the values its formulas calculate. Highlighted [[text]] is for you to replace; rows marked EXAMPLE are for you to delete. Wide sheets scroll sideways. The cover, document control and changelog sheets are in the file.

Instructions

How to use this workbook

Step	What to do
1	Scope: answer for the systems your vulnerability management is meant to cover (all systems owned, managed or operated by or for the organisation). If parts of the estate work very differently, for example a separately run cloud platform, assess them separately in a copy of this workbook.
2	On the Questions sheet, read the four descriptions for each question (columns D to G). Pick the one that matches what actually happens today, not what a policy says should happen. If you are between two, choose the lower. Enter 1, 2, 3 or 4 in column I (Your answer).
3	Use N/A only where a question does not apply to you, for example OWN-04 if no service provider runs any of your systems. N/A answers are left out of the calculation.
4	Note the evidence behind each answer in column L (for example 'coverage report, March'). It makes the next assessment faster and shows an auditor why you chose the level.
5	On the Results sheet, change cell D5 from 'Example profile' to 'My answers'. The levels and the three next actions now describe your programme.
6	Read the three next actions. Each names the document in this pack that helps. Start with action 1; the others can usually run alongside it.
7	Weights are on the Dimensions & Weights sheet. Change one only if you have a reason, and write the reason in column F.
8	Copy the Export table (paste as values) into your records or improvement plan. Repeat the assessment in 6 to 12 months and compare.

Legend

Yellow cells are inputs. Everything else is calculated or fixed — do not overwrite formulas.

EXAMPLE

Rows marked EXAMPLE in the first column show how a completed row looks. Delete them before approval.

The worked example. In this workbook the worked example is a column, not rows: column H of the Questions sheet (headed 'Example answer (EXAMPLE)') holds a complete example profile for a small organisation that scans regularly but has no agreed way to prioritise and closes findings when the ticket closes. While Results cell D5 says 'Example profile', every result is calculated from column H and is labelled EXAMPLE.

To clear the example: set Results cell D5 to 'My answers'. To remove it completely, also select Questions cells H4 to H31 and press Delete. No other cell needs changing.

Answer scale. 1 Not in place: the practice does not exist, or happens only by chance. 2 Informal: it happens, but depends on particular people and is not written down or not done consistently. 3 Defined: it is written down, agreed and done routinely, and leaves a record. 4 Managed: as Defined, and it is also measured, checked by someone else and improved.

How results are worked out. A dimension's level is the average of its answers, rounded to the nearest whole level (exactly half-way rounds down). The three next actions are the dimensions with the highest priority score, where priority score = (4 − level) × weight. Ties go to the dimension earlier in the list. The full rule is written out on the Results sheet.

Tailoring — small organisation: the levels still apply, but 'Defined' can be light: a one-page procedure and a shared spreadsheet count. A fortnightly triage counts as Defined for OWN-02 if volumes are low. Aim for Defined everywhere before Managed anywhere.

Tailoring — regulated financial entity (for example under DORA): raise the weight of Asset scope & coverage and Reporting & governance to 3 on the Dimensions & Weights sheet, because supervisors ask which critical systems are covered and what management decided. Keep the completed workbook with its evidence notes as a record of the review.

Tailoring — IT run by a service provider: answer for what you can see and evidence, not what the provider says it does. Answer OWN-04 carefully; if the provider runs most systems, ask them to complete the evidence column with you. Where you cannot see their scan results, answer level 1 or 2 for the questions that depend on them.

Limitations: see the foot of the Results sheet. In short, this is a self-assessment of how the programme works, not a measurement of how many vulnerabilities you have, and it is only as honest as the answers.

Questions

Pick the description that matches what happens today and enter its number (1–4) in column I. Column H is the worked EXAMPLE profile. Do not overwrite columns J and K: they are calculated.

ID	Dimension	Question	1 — Not in place	2 — Informal	3 — Defined	4 — Managed	Example answer (EXAMPLE)	Answer used	Answer in words
COV-01	Asset scope & coverage	Do you have a list of the systems vulnerability management must cover, with an owner and a criticality rating for each?	No list. Scope is whatever the scanner happens to find.	A list exists but is incomplete or out of date; many systems have no owner or criticality.	A maintained list covers servers, devices, network, cloud and internet-facing systems, each with an owner and criticality.	As Defined, and the list is checked at least monthly against other sources (cloud accounts, directory, network discovery) and gaps are corrected.	3	3	Defined
COV-02	Asset scope & coverage	Do you know what share of in-scope systems were successfully scanned in the last scanning period?	Not known.	Known roughly, or measured only occasionally; clearly below target.	Measured every period, at or close to the 95% target, with unscanned systems listed.	At or above 95% for the last three periods, and every unscanned system has a reason and a date.	2	2	Informal
COV-03	Asset scope & coverage	How do new systems get added to scanning?	Only when someone happens to notice them.	Added when security is told about them, with no deadline.	The build or change process requires them to be added before go-live or within 5 working days.	As Defined, and a regular check finds systems that were missed; the number found is tracked.	2	2	Informal
COV-04	Asset scope & coverage	Do you know which systems can be reached from the internet, and are they scanned from outside?	No list of internet-facing systems, and no scanning from outside.	Some scanning from outside, but not based on a list of what faces the internet.	A list of internet-facing systems exists and they are scanned from outside at least weekly.	As Defined, and the list is compared with what is actually reachable (public addresses, domain records) and differences are investigated.	2	2	Informal
SCN-01	Scanning quality	Are servers and end-user devices scanned with login credentials or an installed agent?	No. Scans look only from the network, so most missing patches are invisible.	Some systems are, but failed logins are not noticed.	Most servers and devices are, and login success is checked every period.	Login success is at or above 95%, and credential failures are fixed within 5 working days.	2	2	Informal
SCN-02	Scanning quality	How often is each kind of system scanned?	Irregularly, when there is time.	On one fixed schedule for everything, less often than monthly.	A frequency is set for each kind of system (for example weekly for internet-facing and Critical systems, monthly for the rest) and it is followed.	As Defined, plus extra scans after significant changes or when a widely exploited vulnerability is announced; missed scans are reported.	3	3	Defined
SCN-03	Scanning quality	Is the scanner's configuration reviewed?	Never reviewed since it was set up.	Looked at only when something goes wrong.	Reviewed at least every 6 months against a written checklist.	As Defined, problems found by the review are tracked until fixed, and daily updates of vulnerability definitions are confirmed.	1	1	Not in place
SCN-04	Scanning quality	Do the people who fix findings trust the scan results?	Results are routinely disputed or ignored.	Disputes are frequent; false positives are handled case by case and not recorded.	A finding is closed as a false positive only with recorded evidence and the standard owner's approval.	As Defined, and recurring false positives are fed back into the scanner set-up so they stop appearing.	2	2	Informal
PRI-01	Prioritisation	How do you decide which findings get fixed first?	No agreed method; whatever is loudest or newest.	The scanner's severity label only (for example, fix every Critical).	A written method that asks whether it is being exploited, whether an attacker can reach it, and how severe it is.	As Defined, and asset criticality and compensating controls adjust the priority, with the reason recorded.	1	1	Not in place
PRI-02	Prioritisation	Do you use information about which vulnerabilities are being exploited in real attacks?	No.	Occasionally, when the news reports a major one.	Every new finding is checked against a known-exploited catalogue, automatically or at triage.	As Defined, and a newly exploited vulnerability triggers a check of the affected systems within one working day.	1	1	Not in place
PRI-03	Prioritisation	Is there an agreed deadline for fixing each priority of finding?	No deadlines.	Deadlines are written down, but IT has not agreed to them.	A deadline for each priority is agreed with IT and approved by management.	As Defined, and the deadlines have been tested against real volumes and are changed when evidence shows they are unrealistic.	2	2	Informal
OWN-01	Ownership & triage rhythm	Does every finding have a named person or team responsible for fixing it?	No. Findings sit in the scanner.	Owners are assigned when someone asks; many findings have none.	Every Priority 1 to 3 finding gets an owner at triage, taken from the asset list.	Owners are assigned automatically from the asset list, and findings without one are reported and resolved within a week.	3	3	Defined
OWN-02	Ownership & triage rhythm	Is there a regular routine for reviewing new and overdue findings?	None.	Ad hoc, or a monthly meeting that is often cancelled.	Weekly (or fortnightly for a small team), following a written procedure, with notes kept.	As Defined, attended by IT and service providers, with decisions and actions recorded and checked at the next meeting.	2	2	Informal
OWN-03	Ownership & triage rhythm	Are emergency (Priority 1) findings handled outside the normal routine?	No different from any other finding.	Handled urgently, but informally and differently each time.	A defined emergency route: mitigate within 72 hours, fix within 7 days, the standard owner told immediately.	As Defined, treated as a potential incident, and reviewed after each use to improve the route.	3	3	Defined
OWN-04	Ownership & triage rhythm	Are service providers who run your systems required to fix vulnerabilities in them? (Answer N/A if you use none.)	No such terms, or not known.	General security terms, with no deadlines.	The agreement includes deadlines and requires evidence that fixes worked.	As Defined, and the provider's performance is reported alongside internal teams'.	N/A	N/A	N/A
REM-01	Remediation within deadlines	Are open findings tracked in one place, with detection date, deadline, owner and status?	No. They exist only in the scanner.	Partly, in a spreadsheet or tickets that are not complete.	Every Priority 1 to 3 finding is recorded with system, priority, owner, detection date and deadline.	As Defined, and the record is updated from each scan, with deadlines counted from first detection.	2	2	Informal
REM-02	Remediation within deadlines	Do you know how many findings are fixed within their deadline?	Not known.	Known, and fewer than half are.	Measured every month, and most are.	The agreed target has been met for the last three periods, and no Priority 1 finding is overdue.	1	1	Not in place
REM-03	Remediation within deadlines	What happens when a finding passes its deadline?	Nothing.	Reminder emails to whoever is fixing it.	Escalated to the asset owner's manager, and to the approver if still open 14 days later.	As Defined, and repeated overdue findings lead management to change capacity or process.	2	2	Informal
VER-01	Verification of fixes	How do you decide that a finding is fixed?	When someone says it is.	When the ticket is closed.	Only when a later scan confirms it has gone, or other objective evidence is attached.	As Defined, closure follows automatically from the confirming scan, and reopened findings are counted.	2	2	Informal
VER-02	Verification of fixes	Do you check that a fix stays fixed?	No.	Only noticed by chance when a finding reappears.	A finding that reappears is reopened with its original detection date.	Recurring findings are traced to their root cause (for example an outdated build image) and fixed at the source.	1	1	Not in place
VER-03	Verification of fixes	Is closure evidence kept so an auditor could check it?	No.	For some findings.	For every closed Priority 1 to 3 finding, kept for the agreed retention period.	As Defined, and someone other than the fixer checks a sample periodically.	1	1	Not in place
EXC-01	Exceptions & risk acceptance	What happens when a finding cannot be fixed on time?	It simply stays open.	An informal agreement, by email or in conversation.	A written exception is requested before the deadline, naming a risk owner and compensating controls.	As Defined, and exceptions for Priority 1 findings are approved at management level.	1	1	Not in place
EXC-02	Exceptions & risk acceptance	Do exceptions expire?	No exceptions are recorded, or they never expire.	Some have dates, but nobody tracks them.	Every exception expires no more than 90 days after approval and is reviewed before renewal.	As Defined, expiries are reported in advance, and renewal needs fresh evidence.	1	1	Not in place
EXC-03	Exceptions & risk acceptance	Are systems your vendors no longer support recorded and managed?	Not known which systems these are.	Known informally.	Recorded with compensating controls and a planned retirement date, and reviewed quarterly.	As Defined, and retirement dates are met or escalated.	2	2	Informal
GOV-01	Reporting & governance	Is there an approved document setting the rules: what is scanned, how often, and the deadlines?	None.	A draft, or one that is out of date.	Approved by management and reviewed in the last 12 months.	As Defined, and compliance with it is measured and reported.	2	2	Informal
GOV-02	Reporting & governance	What is reported to leadership, and how often?	Nothing regular.	Occasional counts of findings by severity.	Monthly to IT leadership: scan coverage, deadline adherence, overdue findings and exceptions.	As Defined, plus quarterly to management, with fixed definitions so periods can be compared.	2	2	Informal
GOV-03	Reporting & governance	Does management take decisions on the reports?	Management does not see the reports.	They see them, but no decisions follow.	Decisions are recorded at least quarterly (for example on overdue risk, capacity or exceptions).	Decisions are followed through to completion and change targets or resources.	1	1	Not in place
GOV-04	Reporting & governance	Is the programme itself reviewed for improvement?	Never.	Only after something goes wrong.	At least yearly (for example with this self-assessment), with actions recorded.	As Defined, and improvement actions are tracked and results compared with the previous review.	1	1	Not in place

Dimensions & Weights

The eight dimensions, their weights (1 = lower value, 3 = highest value) and the action each one produces. Weights are inputs; change one only with a written reason.

No.	Dimension ID	Dimension	What it covers	Weight	Why this weight	Action if Not in place or Informal	Document that helps (Not in place or Informal)	Action if Defined	Document that helps (Defined)
1	COV	Asset scope & coverage	Knowing which systems must be scanned, and whether they actually are.	3	Everything else depends on it: a system that is never scanned has no findings to prioritise or fix.	Build one list of the systems in scope, each with an owner, a criticality rating and whether it faces the internet, and compare it with what the scanner actually scanned last period.	Scan Coverage & Asset Scope Register	Reconcile the scope list at least monthly against other sources (cloud accounts, directory, network discovery) and give every unscanned system a reason and a date.	Scan Coverage & Asset Scope Register
2	SCN	Scanning quality	Whether scans log in, run often enough, and produce results people trust.	2	Poor scans give false comfort, but coverage and prioritisation matter more at first.	Move servers and end-user devices to scanning with credentials or an installed agent, and set a scanning frequency for each kind of system.	Vulnerability Scanner Configuration Review Checklist	Review the scanner set-up against the checklist and fix what it finds; track login success every period and fix credential failures within 5 working days.	Vulnerability Scanner Configuration Review Checklist
3	PRI	Prioritisation	How you decide which findings are fixed first, and how quickly.	3	It decides where limited fixing time goes: the biggest single lever for reducing real risk.	Adopt a written priority method that asks three questions (is it being exploited, can an attacker reach it, how severe is it) and agree a deadline for each priority with IT.	Vulnerability Risk Rating & SLA Model	Let asset criticality and compensating controls adjust priority, with the reason recorded, and test the deadlines against the last three months of findings.	Vulnerability Risk Rating & SLA Model
4	OWN	Ownership & triage rhythm	Who is responsible for each finding, and the regular routine that keeps findings moving.	3	Without a named owner and a weekly routine, findings are found but never fixed.	Start a 30-minute weekly triage: look at new urgent findings, give each one an owner, chase what is late.	Vulnerability Triage & Remediation Operating Procedure	Record decisions and actions at every triage meeting, bring service providers in, and check each action at the next meeting.	Vulnerability Triage & Remediation Operating Procedure
5	REM	Remediation within deadlines	Whether findings are tracked against their deadlines, and what happens when a deadline is missed.	2	It improves mostly as a result of prioritisation and ownership; measure it, but fix the causes first.	Put every Priority 1 to 3 finding in one tracker with its detection date, deadline, owner and status, so you can see what is late.	Vulnerability Remediation Tracker	Escalate overdue findings on a fixed rule (the asset owner's manager first, then the approver after a further 14 days) and report the share fixed on time every month.	Vulnerability & Exposure Management Standard
6	VER	Verification of fixes	How you know a fix worked, and whether the evidence is kept.	2	Without confirmation, reported progress cannot be trusted by you or by an auditor.	Stop closing findings on a ticket update: count a finding as fixed only when a later scan confirms it has gone, and keep that evidence.	Vulnerability Remediation Tracker	Reopen findings that come back with their original detection date, look for the root cause, and have someone other than the fixer sample closures.	Vulnerability Triage & Remediation Operating Procedure
7	EXC	Exceptions & risk acceptance	What happens when a finding cannot be fixed on time, including systems the vendor no longer supports.	1	It matters once deadlines exist; it is worth less until prioritisation and ownership work.	Require a written exception, requested before the deadline passes, naming a risk owner and the compensating controls, with an expiry no more than 90 days away.	Vulnerability & Exposure Management Standard	Report exceptions that expire in the coming month, and require fresh evidence before any exception is renewed.	Vulnerability & Exposure Management Standard
8	GOV	Reporting & governance	Approved rules, regular reporting to leadership, and decisions taken on it.	2	It keeps management support and resources, but needs reliable figures from the other dimensions first.	Start a monthly report on four measures (scan coverage, mean time to remediate, deadline adherence and overdue exposure) using fixed definitions, and get the rules approved by management.	Vulnerability Management Metrics Workbook	Take the figures to management every quarter with the decisions you need from them, and record what they decide.	Vulnerability Posture Management Briefing Deck

Results

Results

Each dimension's result is a level in words. The three next actions are chosen by the rule written out below the tables, so you can check every step.

Results are calculated from:

Example profile

← choose 'My answers' once you have filled column I of the Questions sheet.

EXAMPLE: these results are for the worked example profile, not your organisation. Choose 'My answers' in D5 to see your own.

Overall result

Overall level	Informal	The weight-averaged level of the answered dimensions, rounded to the nearest level. Read it as background; the actions below matter more.
Dimensions at each level	Not in place: 4 · Informal: 3 · Defined: 1 · Managed: 0 · Not answered: 0

Your three highest-value next actions

#	Dimension	Current level	What to do	Document that helps	Why this one	Ranking key	Dimension no.
1	Prioritisation	Not in place	Adopt a written priority method that asks three questions (is it being exploited, can an attacker reach it, how severe is it) and agree a deadline for each priority with IT.	Vulnerability Risk Rating & SLA Model	Not in place, 3 levels below Managed, × weight 3 = priority score 9.	9.06	3
2	Asset scope & coverage	Informal	Build one list of the systems in scope, each with an owner, a criticality rating and whether it faces the internet, and compare it with what the scanner actually scanned last period.	Scan Coverage & Asset Scope Register	Informal, 2 levels below Managed, × weight 3 = priority score 6.	6.08	1
3	Verification of fixes	Not in place	Stop closing findings on a ticket update: count a finding as fixed only when a later scan confirms it has gone, and keep that evidence.	Vulnerability Remediation Tracker	Not in place, 3 levels below Managed, × weight 2 = priority score 6.	6.03	6

Result by dimension

No.	Dimension	Level	What this level means	Questions answered	Weight	Level number	Levels below Managed	Priority score	Ranking key
1	Asset scope & coverage	Informal	It happens, but depends on particular people and is not written down or not done consistently.	4 of 4	3	2	2	6	6.08
2	Scanning quality	Informal	It happens, but depends on particular people and is not written down or not done consistently.	4 of 4	2	2	2	4	4.07
3	Prioritisation	Not in place	The practice does not exist, or happens only by chance.	3 of 3	3	1	3	9	9.06
4	Ownership & triage rhythm	Defined	It is written down, agreed and done routinely, and leaves a record.	3 of 4	3	3	1	3	3.05
5	Remediation within deadlines	Informal	It happens, but depends on particular people and is not written down or not done consistently.	3 of 3	2	2	2	4	4.04
6	Verification of fixes	Not in place	The practice does not exist, or happens only by chance.	3 of 3	2	1	3	6	6.03
7	Exceptions & risk acceptance	Not in place	The practice does not exist, or happens only by chance.	3 of 3	1	1	3	3	3.02
8	Reporting & governance	Not in place	The practice does not exist, or happens only by chance.	4 of 4	2	1	3	6	6.01

How the three actions are chosen

1. Each dimension's level (column H) is the average of its answered questions, rounded to the nearest whole level; exactly half-way rounds down. N/A and blank answers are left out.

2. Levels below Managed (column I) = 4 − level. A Managed dimension scores 0 and produces no action. An unanswered dimension also scores 0.

3. Priority score (column J) = levels below Managed × the dimension's weight from the Dimensions & Weights sheet.

4. Ranking key (column K) = priority score + (9 − dimension number) ÷ 100. This breaks ties in favour of the dimension earlier in the list, because the list runs in the order a programme depends on: scope before scanning, scanning before prioritising, and so on.

5. The three largest ranking keys give the three actions. A dimension at Not in place or Informal gets the 'establish' action; one at Defined gets the 'strengthen' action. Both are on the Dimensions & Weights sheet with the document that helps.

Limitations

This is a self-assessment. It is only as accurate as the answers, and people tend to answer for what should happen rather than what does. Evidence notes in column L of the Questions sheet are the best check.

It measures how the programme works, not how exposed you are today. A Managed programme can still have a serious open vulnerability; use the Remediation Tracker and the Metrics Workbook for that.

The weights and the action wording are a starting point for a typical small or mid-sized organisation. They are not a benchmark, and the levels cannot be compared with other organisations or with certification requirements.

It does not cover patch deployment, penetration testing, secure development or incident response, each of which affects vulnerability risk.

Export

Every answer and result in one table. Select the table, copy, and paste as values into your records or improvement plan. Everything here is calculated; do not type in it.

Section	Ref	Dimension	Item	Answer or level (number)	In words	Detail
Source			Answers used		Example profile	EXAMPLE: these results are for the worked example profile, not your organisation. Choose 'My answers' in D5 to see your own.
Answer	COV-01	Asset scope & coverage	Do you have a list of the systems vulnerability management must cover, with an owner and a criticality rating for each?	3	Defined
Answer	COV-02	Asset scope & coverage	Do you know what share of in-scope systems were successfully scanned in the last scanning period?	2	Informal
Answer	COV-03	Asset scope & coverage	How do new systems get added to scanning?	2	Informal
Answer	COV-04	Asset scope & coverage	Do you know which systems can be reached from the internet, and are they scanned from outside?	2	Informal
Answer	SCN-01	Scanning quality	Are servers and end-user devices scanned with login credentials or an installed agent?	2	Informal
Answer	SCN-02	Scanning quality	How often is each kind of system scanned?	3	Defined
Answer	SCN-03	Scanning quality	Is the scanner's configuration reviewed?	1	Not in place
Answer	SCN-04	Scanning quality	Do the people who fix findings trust the scan results?	2	Informal
Answer	PRI-01	Prioritisation	How do you decide which findings get fixed first?	1	Not in place
Answer	PRI-02	Prioritisation	Do you use information about which vulnerabilities are being exploited in real attacks?	1	Not in place
Answer	PRI-03	Prioritisation	Is there an agreed deadline for fixing each priority of finding?	2	Informal
Answer	OWN-01	Ownership & triage rhythm	Does every finding have a named person or team responsible for fixing it?	3	Defined
Answer	OWN-02	Ownership & triage rhythm	Is there a regular routine for reviewing new and overdue findings?	2	Informal
Answer	OWN-03	Ownership & triage rhythm	Are emergency (Priority 1) findings handled outside the normal routine?	3	Defined
Answer	OWN-04	Ownership & triage rhythm	Are service providers who run your systems required to fix vulnerabilities in them? (Answer N/A if you use none.)	N/A	N/A
Answer	REM-01	Remediation within deadlines	Are open findings tracked in one place, with detection date, deadline, owner and status?	2	Informal
Answer	REM-02	Remediation within deadlines	Do you know how many findings are fixed within their deadline?	1	Not in place
Answer	REM-03	Remediation within deadlines	What happens when a finding passes its deadline?	2	Informal
Answer	VER-01	Verification of fixes	How do you decide that a finding is fixed?	2	Informal
Answer	VER-02	Verification of fixes	Do you check that a fix stays fixed?	1	Not in place
Answer	VER-03	Verification of fixes	Is closure evidence kept so an auditor could check it?	1	Not in place
Answer	EXC-01	Exceptions & risk acceptance	What happens when a finding cannot be fixed on time?	1	Not in place
Answer	EXC-02	Exceptions & risk acceptance	Do exceptions expire?	1	Not in place
Answer	EXC-03	Exceptions & risk acceptance	Are systems your vendors no longer support recorded and managed?	2	Informal
Answer	GOV-01	Reporting & governance	Is there an approved document setting the rules: what is scanned, how often, and the deadlines?	2	Informal
Answer	GOV-02	Reporting & governance	What is reported to leadership, and how often?	2	Informal
Answer	GOV-03	Reporting & governance	Does management take decisions on the reports?	1	Not in place
Answer	GOV-04	Reporting & governance	Is the programme itself reviewed for improvement?	1	Not in place
Dimension result	COV	Asset scope & coverage	Level for the dimension	2	Informal	Weight 3; priority score 6
Dimension result	SCN	Scanning quality	Level for the dimension	2	Informal	Weight 2; priority score 4
Dimension result	PRI	Prioritisation	Level for the dimension	1	Not in place	Weight 3; priority score 9
Dimension result	OWN	Ownership & triage rhythm	Level for the dimension	3	Defined	Weight 3; priority score 3
Dimension result	REM	Remediation within deadlines	Level for the dimension	2	Informal	Weight 2; priority score 4
Dimension result	VER	Verification of fixes	Level for the dimension	1	Not in place	Weight 2; priority score 6
Dimension result	EXC	Exceptions & risk acceptance	Level for the dimension	1	Not in place	Weight 1; priority score 3
Dimension result	GOV	Reporting & governance	Level for the dimension	1	Not in place	Weight 2; priority score 6
Overall result	ALL	All dimensions	Weight-averaged overall level		Informal	Not in place: 4 · Informal: 3 · Defined: 1 · Managed: 0 · Not answered: 0
Next action	Action 1	Prioritisation	Adopt a written priority method that asks three questions (is it being exploited, can an attacker reach it, how severe is it) and agree a deadline for each priority with IT.		Not in place	Document: Vulnerability Risk Rating & SLA Model
Next action	Action 2	Asset scope & coverage	Build one list of the systems in scope, each with an owner, a criticality rating and whether it faces the internet, and compare it with what the scanner actually scanned last period.		Informal	Document: Scan Coverage & Asset Scope Register
Next action	Action 3	Verification of fixes	Stop closing findings on a ticket update: count a finding as fixed only when a later scan confirms it has gone, and keep that evidence.		Not in place	Document: Vulnerability Remediation Tracker

Lists

AnswerLevel	ResultsMode	LevelName	LevelMeaning
1	Example profile	Not in place	The practice does not exist, or happens only by chance.
2	My answers	Informal	It happens, but depends on particular people and is not written down or not done consistently.
3		Defined	It is written down, agreed and done routinely, and leaves a record.
4		Managed	As Defined, and it is also measured, checked by someone else and improved.

N/A

Definitions

Definitions

Term	Meaning in this workbook
Dimension	One of the eight parts of a vulnerability programme this workbook assesses, from asset scope to reporting.
1 — Not in place	The practice does not exist, or happens only by chance.
2 — Informal	It happens, but depends on particular people and is not written down or not done consistently.
3 — Defined	It is written down, agreed and done routinely, and leaves a record.
4 — Managed	As Defined, and it is also measured, checked by someone else and improved.
Weight	How much a gap in a dimension matters compared with the others: 1 lower value, 3 highest value. Set on the Dimensions & Weights sheet.
Priority score	(4 − the dimension's level) × its weight. The higher it is, the more value an improvement there is likely to bring.
Ranking key	The priority score plus a small amount that favours earlier dimensions, so that no two dimensions tie.
N/A	Not applicable: the question does not apply to the organisation. Left out of the calculation.
Authenticated scan	A scan that logs in to the system, or uses an installed agent, so it can see installed software and configuration.
Compensating control	A measure that reduces the risk of a vulnerability that cannot yet be fixed, such as blocking network access to the affected service.
Exception	An approved, time-limited decision not to fix a vulnerability by its deadline, with a named risk owner and compensating controls.
Known-exploited catalogue	A published list of vulnerabilities with reliable evidence of use in real attacks, such as CISA's Known Exploited Vulnerabilities catalogue (CISA is the United States Cybersecurity and Infrastructure Security Agency).
Priority 1 to 4	The pack's four remediation priorities, from Priority 1 — Emergency (mitigate within 72 hours, fix within 7 days) to Priority 4 — Low (90 days). See the Vulnerability Risk Rating & SLA Model.
Scan coverage	The share of in-scope systems successfully scanned in the period.
Standard owner	The person who maintains the Vulnerability & Exposure Management Standard and runs or oversees the programme.

Framework References

Framework references

These references indicate relevance only and do not reproduce the text of any standard.

Framework	Reference	Supported by
ISO/IEC 27001:2022	Clause 9.1 — Monitoring, measurement, analysis and evaluation	Whole workbook
ISO/IEC 27001:2022	Annex A 8.8 — Management of technical vulnerabilities	Questions sheet (all dimensions)
NIST CSF 2.0	ID.IM-01 — “Improvements are identified from evaluations”	Results: next actions
NIS2 — Directive (EU) 2022/2555	Article 21(2)(f) — “policies and procedures to assess the effectiveness of cybersecurity risk-management measures”	Whole workbook

Editions referenced: ISO/IEC 27001:2022 incl. Amd 1:2024; NIST CSF 2.0; Directive (EU) 2022/2555 (NIS2); Regulation (EU) 2022/2554 (DORA); PCI DSS v4.0.1