Establish and Maintain a Remediation Process
Description
Establish and maintain a risk-based remediation strategy documented in a remediation process, with monthly, or more frequent, reviews.
Implementation Checklist
Tool Recommendations
Continuous vulnerability assessment and exposure management across IT assets, cloud, containers, and OT
Tenable · Per-asset subscription
Cloud-based vulnerability management, detection, and response with integrated patch management and asset inventory
Qualys · Per-asset subscription
Vulnerability management platform with live dashboards, risk prioritization, and remediation workflows
Rapid7 · Per-asset subscription
Threats & Vulnerabilities (CIS RAM)
Threat Scenarios
Exploitation of Vulnerabilities with No Remediation SLA
ConfidentialityAttackers exploit known vulnerabilities that persist for months because no risk-based remediation timeline exists, allowing threat actors to weaponize public exploits long before patches are applied.
Patch Rollback Attacks Due to Untested Remediation
AvailabilityWithout a structured remediation process, hastily applied patches cause system instability and are rolled back, re-exposing the vulnerability while the organization scrambles for a stable fix.
Exception Abuse from Unmanaged Remediation Deferrals
IntegrityVulnerabilities are permanently deferred without documented risk acceptance or compensating controls, creating a growing backlog of unpatched systems that accumulate exploitable weaknesses over time.
Vulnerabilities (When Safeguard Absent)
No Risk-Based Remediation Timelines
The organization has no defined SLAs linking vulnerability severity to remediation deadlines (e.g., critical within 48 hours, high within 14 days), allowing dangerous vulnerabilities to remain open indefinitely.
No Formal Exception or Risk Acceptance Process
When vulnerabilities cannot be immediately remediated, there is no process for documenting exceptions, compensating controls, or risk acceptance decisions, leaving unpatched systems without any mitigating oversight.
Evidence Requirements
| Type | Evidence Item | Collection Frequency |
|---|---|---|
| Document | Response procedure/playbook documentation | Reviewed bi-annually |
| Record | Response action logs showing procedure execution | Per incident |
| Document | Governing policy document (current, approved, communicated) | Reviewed annually |