Manage security vulnerabilities

Validate reported weaknesses, affected assets, exploitability, exposure, business criticality, vendor guidance, and safe remediation options before prioritizing and changing systems.

Field	Value
Business area	security-continuity
Primary role	it-security-administrator
Frequency	weekly
Privacy sensitivity	medium
Security sensitivity	high
Compliance review	needed

Trigger and handoff

Trigger: A scanner, vendor, researcher, or incident identifies a potential vulnerability.

Inputs

• Vulnerability evidence
• Accurate asset and exposure context
• Remediation
• mitigation
• and rollback information

Outputs

• Risk-informed priority and owner
• Tested remediation or mitigation
• Accepted residual risk and review date

Current manual methods

• Scanner severity queue
• Patch everything immediately
• Annual penetration test list

Human judgment and approvals

• Assess credible attack path and consequence

• Balance remediation urgency

• safety

• continuity

• and testability

• Approval: Technical owner approves change; business owner accepts material residual risk

Failure modes

• Score replaces exposure analysis
• Patch disrupts service or does not address actual configuration

Success metrics

• Internet-exposed and critical risks meet approved response targets
• Remediation is verified rather than inferred from deployment