npx claudepluginhub plurigrid/asi --plugin asiThis skill uses the workspace's default tool permissions.
Vulnerability remediation SLAs define mandatory timeframes for patching or mitigating identified vulnerabilities based on severity, asset criticality, and exploit availability. Effective SLA programs drive accountability, ensure consistent remediation timelines, and provide measurable KPIs for vulnerability management maturity.
Guides implementation of vulnerability remediation SLAs with severity/asset timelines, exception processes, escalations, accelerators like CISA KEV/EPSS, and reporting KPIs.
Guides implementation of vulnerability remediation SLAs defining patch timelines by CVSS severity, asset tiers, and exploit factors like EPSS/KEV. Provides matrices, steps, KPIs, and processes for cybersecurity teams.
Builds vulnerability aging dashboards and SLA tracking systems to monitor remediation against severity-based timelines, with KPIs for compliance and accountability.
Share bugs, ideas, or general feedback.
Vulnerability remediation SLAs define mandatory timeframes for patching or mitigating identified vulnerabilities based on severity, asset criticality, and exploit availability. Effective SLA programs drive accountability, ensure consistent remediation timelines, and provide measurable KPIs for vulnerability management maturity.
| Severity | Tier 1 (Critical) | Tier 2 (Important) | Tier 3 (Standard) |
|---|---|---|---|
| Critical (CVSS 9.0-10.0) | 24-48 hours | 72 hours | 7 days |
| High (CVSS 7.0-8.9) | 7 days | 14 days | 30 days |
| Medium (CVSS 4.0-6.9) | 30 days | 45 days | 60 days |
| Low (CVSS 0.1-3.9) | 90 days | 90 days | 90 days |
| CISA KEV Listed | 24 hours | 48 hours | 7 days |
Tier 1 (Critical Assets):
- Customer-facing production systems
- Payment processing infrastructure
- Domain controllers and identity systems
- Core network infrastructure (firewalls, routers)
- Databases containing PII/PHI/PCI data
Tier 2 (Important Assets):
- Internal production applications
- Email and collaboration systems
- Development/staging environments with production data
- Backup and recovery infrastructure
- VPN and remote access gateways
Tier 3 (Standard Assets):
- End-user workstations
- Development/test environments
- Print servers and peripheral management
- Non-critical internal tools
Key sections to include:
# ServiceNow / Jira integration for automatic ticket creation
# See process.py for full implementation
# Key fields for remediation tickets:
# - Vulnerability ID (CVE/Plugin ID)
# - Affected host(s)
# - Severity (CVSS + contextual factors)
# - Asset tier
# - SLA deadline (calculated from discovery date)
# - Assignment group
# - Remediation instructions
# - Verification criteria
SLA Status Action Notify
───────────────────────────────────────────────────────────
75% elapsed Warning email Asset owner
100% elapsed SLA breach notification Manager + CISO
100% + 7 days Executive escalation VP/CTO
100% + 30 days Risk acceptance required CISO approval
100% + 90 days Compensating controls mandatory Board report
Valid exception reasons:
Exception requirements:
| KPI | Definition | Target |
|---|---|---|
| SLA Compliance Rate | % of vulns remediated within SLA | >90% |
| Mean Time to Remediate (MTTR) | Average days from discovery to fix | Critical: <3d, High: <10d |
| Vulnerability Backlog | Open vulnerabilities past SLA | <5% of total |
| Exception Rate | % of findings with active exceptions | <10% |
| Recurrence Rate | % of vulns that reappear after remediation | <5% |