Vulnerability Management

Vulnerability Management

Authorized By: Chief Information Security Officer (CISO)

Purpose/Overview

Our Vulnerability Management Policy is designed to identify, assess, prioritize, and remediate vulnerabilities in our technology infrastructure systematically. This policy provides clear guidelines for monitoring, analyzing, and mitigating vulnerabilities to enhance system security and reduce the risk of exploitation. Through practices like vulnerability scanning, penetration testing, and remediation, we aim to address security weaknesses promptly, minimize threats, and protect our data and networks. This proactive approach improves our cybersecurity posture, helps maintain compliance with industry standards, and ensures stakeholder trust and confidence.

Scope

This Policy applies to all Safire employees, contractors, and stakeholders, covering the identification, assessment, prioritization, mitigation, and monitoring of vulnerabilities across all IT systems and devices. It establishes mandatory procedures for scanning, testing, remediation, reporting, and patch management, defines roles and responsibilities, and requires approvals for any exceptions to ensure effective risk reduction and compliance.

Policy

To achieve Safire’s overall mission, and the purpose of this policy, Safire shall:

• Maintain an enterprise VM (Vulnerability Management) system to detect, track, and report vulnerabilities in Safire systems and applications using agents and/or authenticated scans.
• Scan for weaknesses due to outdated/vulnerable software (CVEs/CVSS), misconfigurations (CCE/benchmarks), and open or dangerous ports/services.
• Prioritize vulnerabilities using risk-based methods and verified threat intelligence (including exploit status).
• Compare scan results over time to evidence remediation progress and trend reduction.
• Track open vulnerabilities and time-bound, CISO-approved exceptions in a central system of record.
• Provide regular vulnerability reporting to technical teams, business owners, executive leadership, and the Executive Leadership Team (ELT) as defined under Reporting and Metrics.
• Conduct risk assessments regularly to inform VM focus areas. See Safire Risk Assessment Policy.
• Require CISO approval for any deviation from this policy, including extended remediation timelines or acceptance of risk.

Vulnerability Scanning and Remediation

Vulnerability Scanning Frequency

• Mission-Critical Equipment: Weekly.

• Internet-Facing Servers/Services: Daily.

• End-User Devices (desktops, laptops, mobile): Weekly.

• Network Devices (routers, switches, firewalls): Monthly.

• Other Infrastructure Devices and Non-Internet-Facing Servers: Monthly.

• Changes to these frequencies require CISO, IT or Compliance personnel approval.

Vulnerability Risk Classification & Remediation Timeframes (SLA)

Safire uses a tiered risk model to prioritize remediation efforts based on the Common Vulnerability Scoring System (CVSS) and active threat intelligence.

• Critical Risk:
• Definition: Vulnerabilities with a CVSS score of 9.0 - 10.0, OR any vulnerability being actively exploited in the wild (Zero-Day), regardless of score.
• SLA: Remediate or apply CISO-approved compensating controls within 14 days of detection.
• High Risk:
• Definition: Vulnerabilities with a CVSS score of 7.0 - 8.9.
• SLA: Remediate within 30 days of detection.
• Medium Risk:
• Definition: Vulnerabilities with a CVSS score of 4.0 - 6.9.
• SLA: Remediate within 90 days of detection or during the next scheduled quarterly maintenance window.
• Low Risk:
• Definition: Vulnerabilities with a CVSS score of 0.0 - 3.9.
• SLA: Remediate on a best-effort basis during standard system lifecycle updates.

Escalation Procedures

• Immediate Notification: Critical-Risk discoveries trigger immediate notification to the CISO and impacted System/Business Owners.
• Deadline Monitoring: Non-remediated Critical-Risk items at 10 days (or 25 days for HighRisk ) prompt written escalation by the CISO to the accountable owner with a remediation plan due within 24 hours.
• Executive Escalation: If Critical-Risk vulnerabilities remain unresolved by SLA or if there are disputes, resource constraints, or refusals impacting timely remediation, the CISO escalates directly to the Executive Leadership Team (ELT) or Risk Committee with recommended actions and business impact.
• Emergency Authority: For imminent threats, the CISO may requ i re immediate compensating controls (e.g., access blocks, service isolation) with retrospective ratification within 72 hours.

Vulnerabilities in Third-Party Software (including Cloud)

• Maintain a complete, versioned inventory of technology components (OS, databases, web servers, desktop software, browsers, application platforms, hardware, cloud services).
• Subscribe to vendor advisories and trusted threat intel; ensure competent staff review and triage.
• Apply vendor-recommended configuration changes via the change management process; deferrals require CISO approval.
• Define shared responsibility with CSPs (IaaS/PaaS/SaaS) and ensure contractual SLAs for vulnerability assessment and patching; collect evidence of CSP compliance.

Patches and Updates

• Establish procedures to obtain, validate, and schedule updates, considering criticality, outage requirements, risk, dependencies, and coordination across components.
• Maintain an update release plan managed through change management; leverage standard change models where appropriate.
• Automate security updates when feasible and verify success with monitoring and reporting.
• Deferrals or risk acceptance for third-party delays require CISO approval with documented compensating controls and vendor escalation.

Vulnerability Assessment and Penetration Testing

• Perform organization-wide vulnerability assessments at least twice per year, guided by the latest risk assessment.
• Minimum scope:
• All external ingress points
• Externally facing web applications/services
• Business-critical internal servers
• Representative endpoint devices
• Cloud-hosted virtual infrastructure
• Commission penetration tests as needed. Obtain CSP/hosting permissions prior to testing. Findings feed into VM tracking and remediation SLAs.

Hardening

• Implement vendor and industry benchmark-aligned hardening (e.g., CIS/NIST) to reduce attack surface.
• Govern hardening via change management. Exceptions or deviations require CISO approval

Awareness and Training

• Provide periodic training on vulnerabilities, secure configurations, patching discipline, and reporting procedures.

Third-Party Vulnerability Disclosure (Responsible Disclosure)

When Safire discovers a new, unpatched third-party vulnerability:

• Follow the developer’s disclosure policy when available; otherwise, notify the vendor responsibly and confidentially.
• Maintain confidentiality for 60 days to allow remediation, unless threat conditions warrant a different timeline approved by the CISO and Legal.
• Any external publication requires prior CISO and Legal approval and should use recognized platforms (e.g., CERT/CC).

Reporting and Metrics

• Operational dashboards (weekly to CISO and IT): open vulnerabilities by severity, age, SLA status, compensating controls, and exceptions.

• Executive summary (monthly to ELT): Critical and High-Risk backlog and age, SLA adherence, mean time to remediate (MTTR), trends, material exceptions, and top risks/recommendations.

• Board-level summary (quarterly or as requested): risk posture, critical trends, major escalations, and resourcing needs

Records and Evidence

• Maintain records of scan results, remediation tickets, exceptions, approvals, and escalations for a minimum of 3 years or longer if required by regulation or contract.
• The system of record for vulnerabilities and exceptions is owned by the CISO.

Compliance

Compliance Measurement

The policy owner will verify compliance through methods such as business tool reports and internal and external audits. Oversight is provided by CISO, IT, and Compliance functions, which do not have direct enforcement authority without escalation to the CEO.

Exceptions

Any exceptions must be approved by the Policy Owner in advance.

Non-Compliance

Non-compliance with this policy may result in disciplinary action in line with Safire’s human resource procedures. Violations may result in disciplinary action ranging from mandatory retraining to termination and legal liability. These sanctions underscore the critical importance of cybersecurity and each individual’s role in mitigating risk to our digital assets. Enforcement will be consistent and impartial, with the severity of the action corresponding directly to the seriousness of the breach.

Related Standards, Policies, Plans, and Procedures

Risk Assessment Policy

Definitions

Term	Definition
CVSS	Common Vulnerability Scoring System
CVE	Common Vulnerabilities and Exposures
CCE	Common Configuration Enumeration
CSP	Cloud Service Provider
SLA	Service Level Agreement
Zero-Day	A vulnerability that has been disclosed but has no available patch or fix.

Revision History

2026-08-20 — Darren Rush

Merge pull request #2 from safire-dev/dev (16cb681)

Edit this Page