# Vulnerability Management Standard

**Template version:** 1.0.0 · **Edition:** Annotated (with guidance) · **NIST basis:** SP 800-53 Rev. 5, release 5.2.0

*Tailor this template before adoption; it is not legal advice.* Latest version: <https://kston83.github.io/nist-guide/templates/standards/vulnerability-management-standard/>. Dedicated to the public domain under CC0 1.0 (<https://creativecommons.org/publicdomain/zero/1.0/>): adopt and change it without attribution.

> **Guidance:** The risk assessment policy says vulnerabilities must be found and fixed; this standard says how often, how thoroughly and how fast. Keep the values here in step with the RA-5 statements in the policy, since assessors compare the two. Patch deployment itself belongs to the [Patch and Flaw Remediation Standard](https://kston83.github.io/nist-guide/templates/standards/patch-and-flaw-remediation-standard/) (SI-2); this standard covers finding, rating and tracking vulnerabilities to closure.

| Owner | Approved by | Version | Effective date |
| --- | --- | --- | --- |
| [Chief Information Security Officer] | [Fill in: name and title] | [Fill in: version] | [Fill in: date] |

## 1. Purpose and scope

This standard sets the minimum requirements for finding, rating, fixing and tracking vulnerabilities in the systems of [Organization name]. It applies to every system in the system inventory and every component in each system's component inventory, including cloud services, containers and applications the organization develops or hosts.

## 2. Roles

| Role | Responsibilities |
| --- | --- |
| [Chief Information Security Officer] | Owns this standard; provides the scanning tools and the vulnerability management function; reports status to leadership |
| [Fill in: vulnerability management function, for example the security operations team] | Runs scans, keeps scanner checks current, analyzes results, assigns findings, and measures coverage and timeliness |
| [System owner] | Keeps the component inventory complete, fixes findings on the system within the times below, and requests exceptions |
| Authorizing official | Decides on risk acceptances for the system, within the tolerance the risk management strategy sets |

## 3. Monitoring and scanning

- Each system and its hosted applications shall be monitored for newly reported vulnerabilities [Fill in: frequency for monitoring systems and hosted applications for vulnerabilities. Typical: continuously, through vendor advisories, vulnerability feeds and the CISA Known Exploited Vulnerabilities Catalog]. (RA-5a)
- Each system and its hosted applications shall be scanned [Fill in: frequency for scanning systems and hosted applications for vulnerabilities. Typical: at least monthly for infrastructure, and before each major release for applications], and when a new vulnerability that may affect the system is reported. (RA-5a)
- Scans shall cover every component in the system's component inventory, and each cycle shall report components the scan missed, with the reason. (RA-5a)
- The vulnerability management function shall have privileged access to [Fill in: system components to which privileged access is authorized for selected vulnerability scanning activities. Typical: operating systems, databases and web applications] for [Fill in: vulnerability scanning activities selected for privileged access authorization to system components. Typical: credentialed (authenticated) vulnerability scans]. (RA-5(5))
- Scanning accounts shall be managed as privileged accounts and used only by the scanning tools. (RA-5(5))
- The vulnerabilities the scanning tools check for shall be updated [Select one or more: [Assignment: organization-defined frequency]; prior to a new scan; when new vulnerabilities are identified and reported. Typical: prior to a new scan]. (RA-5(2))
- Scanning tools shall report findings using standard identifiers and scores, such as CVE for software flaws, CPE for platforms and CVSS for severity. (RA-5b)

| Asset type | Method | Frequency |
| --- | --- | --- |
| Servers, workstations and network devices | Authenticated network or agent-based scan | [Fill in: for example monthly, and weekly for internet-facing hosts] |
| Web applications and APIs | Dynamic application scan | [Fill in: for example before each major release and at least quarterly] |
| Code the organization develops | Static analysis and dependency (software composition) scan | [Fill in: for example on every build] |
| Container images | Image scan | [Fill in: for example at build and before deployment, and daily for images in production] |
| Cloud accounts and services | Configuration assessment against the organization's baselines | [Fill in: for example continuously, with daily reports] |
| Databases | Authenticated database scan | [Fill in: for example monthly] |

## 4. Analysis and rating

- The vulnerability management function shall analyze each scan and monitoring result, remove duplicates, and assign each finding to the system owner. (RA-5c)
- A finding judged a false positive shall be closed only with a recorded reason and the name of the person who judged it. (RA-5c)
- Each finding shall be given a severity from its CVSS base score, raised where the vulnerability is known to be exploited, the component is exposed to the internet, or the component is critical to the system (RA-9). (RA-5d)

| Severity | CVSS base score | Other reasons to use this rating |
| --- | --- | --- |
| Known exploited | Any | Listed in the CISA Known Exploited Vulnerabilities Catalog, or exploitation seen by the organization |
| Critical | [Fill in: for example 9.0 to 10.0] | [Fill in: for example a high finding on an internet-facing component] |
| High | [Fill in: for example 7.0 to 8.9] | [Fill in: conditions] |
| Moderate | [Fill in: for example 4.0 to 6.9] | [Fill in: conditions] |
| Low | [Fill in: for example 0.1 to 3.9] | [Fill in: conditions] |

> **Guidance:** The example score ranges are the qualitative severity rating scale in section 7 of the [CVSS v4.0 specification](https://www.first.org/cvss/v4.0/specification-document) (FIRST, November 2023, current as of September 2026), which calls the middle band "Medium". Scanners often still report CVSS v3.1 scores, which use the same ranges.

## 5. Remediation times

- System owners shall remediate legitimate vulnerabilities within [Fill in: response times to remediate legitimate vulnerabilities in accordance with an organizational assessment of risk. Typical: known exploited: as soon as possible, within days; critical and high: 30 days; moderate: 90 days; low: 180 days], counted from the date the finding is first reported to them. (RA-5d)
- A finding is remediated when a later scan, or other recorded evidence, shows the vulnerability is gone. (RA-5d)

| Severity | Remediation time |
| --- | --- |
| Known exploited | [Fill in: for example 14 days, or sooner when the vulnerability is on an internet-facing component] |
| Critical | [Fill in: for example 30 days] |
| High | [Fill in: for example 30 days] |
| Moderate | [Fill in: for example 90 days] |
| Low | [Fill in: for example 180 days] |

## 6. Exceptions

- A vulnerability that cannot be remediated in time shall be entered in the system's plan of action and milestones, with a planned date, before its remediation time ends. (RA-7)
- A vulnerability that will not be remediated shall be accepted only by an official the risk management strategy authorizes to accept risk at its level, with the compensating measures and an expiry date recorded. (RA-7)
- Exceptions shall be reviewed [Fill in: for example quarterly] and at expiry. (RA-7)

## 7. Discoverable information

This section applies to High systems.

- The vulnerability management function shall determine what information about the system is discoverable from outside, [Fill in: for example quarterly, and with each penetration test]. (RA-5(4))
- Discoverable information shall be handled by [Fill in: corrective actions to be taken if information about the system is discoverable. Typical: removing or restricting the information where possible, and treating any that exposes a weakness as a finding for the plan of action and milestones]. (RA-5(4))

## 8. Public vulnerability reports

- The [Chief Information Security Officer] shall publish a vulnerability disclosure policy that says which systems are in scope, how to report a vulnerability, and that good-faith research within the policy is authorized. (RA-5(11))
- The [Security operations team] shall acknowledge each report within [Fill in: for example 3 business days] and handle a confirmed vulnerability as a finding under this standard. (RA-5(11))

## 9. Sharing and reporting

- The vulnerability management function shall share information obtained from vulnerability monitoring and control assessments with [Fill in: personnel or roles with whom information obtained from the vulnerability scanning process and control assessments is to be shared. Typical: the owners of similar systems and the security operations team], to help eliminate similar vulnerabilities in other systems. (RA-5e)
- The [Chief Information Security Officer] shall report [Fill in: for example monthly] on scan coverage, open findings by severity and age, remediation within the set times, and open exceptions. (RA-5e)

### Federal systems

CISA binding operational directives set minimums for federal civilian agencies (as of September 2026). Set the values in sections 3 and 5 no weaker than these.

- [BOD 26-04](https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk), Prioritizing Security Updates Based on Risk (June 10, 2026), sets remediation deadlines by exposure, KEV status, whether exploitation can be automated, and technical impact; its clock starts when CISA adds a vulnerability to the KEV catalog or the agency identifies it, whichever is first. It revoked BOD 22-01 and BOD 19-02.
- [BOD 23-01](https://www.cisa.gov/news-events/directives/bod-23-01-improving-asset-visibility-and-vulnerability-detection-federal-networks), Improving Asset Visibility and Vulnerability Detection on Federal Networks (October 3, 2022), requires automated asset discovery every 7 days and vulnerability enumeration across discovered assets every 14 days.
- [BOD 20-01](https://www.cisa.gov/news-events/directives/bod-20-01-develop-and-publish-vulnerability-disclosure-policy), Develop and Publish a Vulnerability Disclosure Policy (September 2, 2020), requires a published vulnerability disclosure policy.

- Remediation times in section 5 shall be no longer than the deadlines BOD 26-04 sets. (RA-5d)
- Asset discovery shall run at least every 7 days, and vulnerability enumeration at least every 14 days, as BOD 23-01 requires. (RA-5a)
- The vulnerability disclosure policy in section 8 shall meet BOD 20-01. (RA-5(11))

## 10. Review

The [Chief Information Security Officer] reviews this standard [Fill in: for example annually], and whenever the risk assessment policy, a CISA directive or the organization's risk tolerance changes.

| Version | Date | Change | Approved by |
| --- | --- | --- | --- |
| [Fill in: version] | [Fill in: date] | [Fill in: summary of change] | [Fill in: name and title] |