Vulnerability Management Standard

Vulnerability Management Standard template: The scanning coverage, frequencies, remediation times and exception rules that make the risk assessment policy's vulnerability requirements (SP 800-53 RA-5) measurable.

Type	Program stage	Status	Template version	NIST basis
Standard	Core	Draft	1.0.0	SP 800-53 release 5.2.0

What it is

The scanning coverage, frequencies, remediation times and exception rules that make the risk assessment policy’s vulnerability requirements (SP 800-53 RA-5) measurable.

Controls satisfied

Control	Title
RA-5	Vulnerability Monitoring and Scanning
RA-5(2)	Update Vulnerabilities to Be Scanned
RA-5(4)	Discoverable Information
RA-5(5)	Privileged Access
RA-5(11)	Public Disclosure Program

Downloads

Variant	Ready to adopt	Annotated
All baselines	Word · Markdown	Word · Markdown

Preview (annotated)

Guidance

The risk assessment policy says vulnerabilities must be found and fixed; this standard says how often, how thoroughly and how fast. Keep the values here in step with the RA-5 statements in the policy, since assessors compare the two. Patch deployment itself belongs to the Patch and Flaw Remediation Standard (SI-2); this standard covers finding, rating and tracking vulnerabilities to closure.

Owner	Approved by	Version	Effective date
Chief Information Security Officer	Fill in: name and title	Fill in: version	Fill in: date

1. Purpose and scope

This standard sets the minimum requirements for finding, rating, fixing and tracking vulnerabilities in the systems of Organization name. It applies to every system in the system inventory and every component in each system’s component inventory, including cloud services, containers and applications the organization develops or hosts.

2. Roles

Role	Responsibilities
Chief Information Security Officer	Owns this standard; provides the scanning tools and the vulnerability management function; reports status to leadership
Fill in: vulnerability management function, for example the security operations team	Runs scans, keeps scanner checks current, analyzes results, assigns findings, and measures coverage and timeliness
System owner	Keeps the component inventory complete, fixes findings on the system within the times below, and requests exceptions
Authorizing official	Decides on risk acceptances for the system, within the tolerance the risk management strategy sets

3. Monitoring and scanning

• Each system and its hosted applications shall be monitored for newly reported vulnerabilities Fill in: frequency for monitoring systems and hosted applications for vulnerabilities Typical: continuously, through vendor advisories, vulnerability feeds and the CISA Known Exploited Vulnerabilities Catalog. (RA-5a)
• Each system and its hosted applications shall be scanned Fill in: frequency for scanning systems and hosted applications for vulnerabilities Typical: at least monthly for infrastructure, and before each major release for applications, and when a new vulnerability that may affect the system is reported. (RA-5a)
• Scans shall cover every component in the system’s component inventory, and each cycle shall report components the scan missed, with the reason. (RA-5a)
• The vulnerability management function shall have privileged access to Fill in: system components to which privileged access is authorized for selected vulnerability scanning activities Typical: operating systems, databases and web applications for Fill in: vulnerability scanning activities selected for privileged access authorization to system components Typical: credentialed (authenticated) vulnerability scans. (RA-5(5))
• Scanning accounts shall be managed as privileged accounts and used only by the scanning tools. (RA-5(5))
• The vulnerabilities the scanning tools check for shall be updated Select one or more: [Assignment: organization-defined frequency]; prior to a new scan; when new vulnerabilities are identified and reported Typical: prior to a new scan. (RA-5(2))
• Scanning tools shall report findings using standard identifiers and scores, such as CVE for software flaws, CPE for platforms and CVSS for severity. (RA-5b)

Asset type	Method	Frequency
Servers, workstations and network devices	Authenticated network or agent-based scan	Fill in: for example monthly, and weekly for internet-facing hosts
Web applications and APIs	Dynamic application scan	Fill in: for example before each major release and at least quarterly
Code the organization develops	Static analysis and dependency (software composition) scan	Fill in: for example on every build
Container images	Image scan	Fill in: for example at build and before deployment, and daily for images in production
Cloud accounts and services	Configuration assessment against the organization’s baselines	Fill in: for example continuously, with daily reports
Databases	Authenticated database scan	Fill in: for example monthly

4. Analysis and rating

• The vulnerability management function shall analyze each scan and monitoring result, remove duplicates, and assign each finding to the system owner. (RA-5c)
• A finding judged a false positive shall be closed only with a recorded reason and the name of the person who judged it. (RA-5c)
• Each finding shall be given a severity from its CVSS base score, raised where the vulnerability is known to be exploited, the component is exposed to the internet, or the component is critical to the system (RA-9). (RA-5d)

Severity	CVSS base score	Other reasons to use this rating
Known exploited	Any	Listed in the CISA Known Exploited Vulnerabilities Catalog, or exploitation seen by the organization
Critical	Fill in: for example 9.0 to 10.0	Fill in: for example a high finding on an internet-facing component
High	Fill in: for example 7.0 to 8.9	Fill in: conditions
Moderate	Fill in: for example 4.0 to 6.9	Fill in: conditions
Low	Fill in: for example 0.1 to 3.9	Fill in: conditions

Guidance

The example score ranges are the qualitative severity rating scale in section 7 of the CVSS v4.0 specification (FIRST, November 2023, current as of September 2026), which calls the middle band “Medium”. Scanners often still report CVSS v3.1 scores, which use the same ranges.

5. Remediation times

• System owners shall remediate legitimate vulnerabilities within Fill in: response times to remediate legitimate vulnerabilities in accordance with an organizational assessment of risk Typical: known exploited: as soon as possible, within days; critical and high: 30 days; moderate: 90 days; low: 180 days, counted from the date the finding is first reported to them. (RA-5d)
• A finding is remediated when a later scan, or other recorded evidence, shows the vulnerability is gone. (RA-5d)

Severity	Remediation time
Known exploited	Fill in: for example 14 days, or sooner when the vulnerability is on an internet-facing component
Critical	Fill in: for example 30 days
High	Fill in: for example 30 days
Moderate	Fill in: for example 90 days
Low	Fill in: for example 180 days

6. Exceptions

• A vulnerability that cannot be remediated in time shall be entered in the system’s plan of action and milestones, with a planned date, before its remediation time ends. (RA-7)
• A vulnerability that will not be remediated shall be accepted only by an official the risk management strategy authorizes to accept risk at its level, with the compensating measures and an expiry date recorded. (RA-7)
• Exceptions shall be reviewed Fill in: for example quarterly and at expiry. (RA-7)

7. Discoverable information

This section applies to High systems.

• The vulnerability management function shall determine what information about the system is discoverable from outside, Fill in: for example quarterly, and with each penetration test. (RA-5(4))
• Discoverable information shall be handled by Fill in: corrective actions to be taken if information about the system is discoverable Typical: removing or restricting the information where possible, and treating any that exposes a weakness as a finding for the plan of action and milestones. (RA-5(4))

8. Public vulnerability reports

• The Chief Information Security Officer shall publish a vulnerability disclosure policy that says which systems are in scope, how to report a vulnerability, and that good-faith research within the policy is authorized. (RA-5(11))
• The Security operations team shall acknowledge each report within Fill in: for example 3 business days and handle a confirmed vulnerability as a finding under this standard. (RA-5(11))

9. Sharing and reporting

• The vulnerability management function shall share information obtained from vulnerability monitoring and control assessments with Fill in: personnel or roles with whom information obtained from the vulnerability scanning process and control assessments is to be shared Typical: the owners of similar systems and the security operations team, to help eliminate similar vulnerabilities in other systems. (RA-5e)
• The Chief Information Security Officer shall report Fill in: for example monthly on scan coverage, open findings by severity and age, remediation within the set times, and open exceptions. (RA-5e)

Federal systems

CISA binding operational directives set minimums for federal civilian agencies (as of September 2026). Set the values in sections 3 and 5 no weaker than these.

• BOD 26-04, Prioritizing Security Updates Based on Risk (June 10, 2026), sets remediation deadlines by exposure, KEV status, whether exploitation can be automated, and technical impact; its clock starts when CISA adds a vulnerability to the KEV catalog or the agency identifies it, whichever is first. It revoked BOD 22-01 and BOD 19-02.

• BOD 23-01, Improving Asset Visibility and Vulnerability Detection on Federal Networks (October 3, 2022), requires automated asset discovery every 7 days and vulnerability enumeration across discovered assets every 14 days.

• BOD 20-01, Develop and Publish a Vulnerability Disclosure Policy (September 2, 2020), requires a published vulnerability disclosure policy.

• Remediation times in section 5 shall be no longer than the deadlines BOD 26-04 sets. (RA-5d)

• Asset discovery shall run at least every 7 days, and vulnerability enumeration at least every 14 days, as BOD 23-01 requires. (RA-5a)

• The vulnerability disclosure policy in section 8 shall meet BOD 20-01. (RA-5(11))

10. Review

The Chief Information Security Officer reviews this standard Fill in: for example annually, and whenever the risk assessment policy, a CISA directive or the organization’s risk tolerance changes.

Version	Date	Change	Approved by
Fill in: version	Fill in: date	Fill in: summary of change	Fill in: name and title