skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

implementing-vulnerability-remediation-sla

Implements vulnerability remediation SLAs with severity-based deadlines, asset tiering, and escalation workflows.

954|172|Updated Mar 13, 2026
Search Tags:#remediation#vulnerability management#risk#patch management#cvss#sla#CISA KEV
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill implementing-vulnerability-remediation-sla
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: implementing-vulnerability-remediation-sla
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/vulnerability-management/implementing-vulnerability-remediation-sla
Command: npx skills add https://github.com/xalgord/xalgorix --skill implementing-vulnerability-remediation-sla

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Security teams often lack enforceable timelines for fixing vulnerabilities, leaving critical CVEs unpatched for months. This Skill provides a complete framework for defining, enforcing, and measuring vulnerability remediation SLAs based on severity, asset criticality, and real-world exploit availability.

Core Features & Use Cases

  • SLA Matrix Design: Define remediation deadlines by CVSS severity and asset tier, with accelerators for CISA KEV listings, high EPSS scores, and internet-facing exposure.
  • Escalation & Exception Management: Configure escalation chains (75%/100%/+7d/+30d thresholds) and a governed exception process with compensating controls and 90-day caps.
  • KPI Tracking: Measure SLA compliance rate, MTTR, backlog, exception rate, and recurrence rate for executive reporting.
  • Use Case: A security team integrating with Jira or ServiceNow can auto-generate remediation tickets with calculated deadlines from discovery date, then report monthly SLA compliance trends to leadership.

Quick Start

Ask the AI to design a vulnerability remediation SLA policy with asset tiering, escalation rules, and KPIs for your organization.

Frequently Asked Questions about implementing-vulnerability-remediation-sla

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I set vulnerability remediation SLAs by severity?▼

Define a matrix mapping CVSS severity bands to deadlines per asset tier, for example 24-48 hours for critical vulnerabilities on Tier-1 assets and 30 days for medium severity. Reduce deadlines by 50% when exploits are public or the CVE is on the CISA KEV list.

What is a good SLA for critical vulnerabilities?▼

A common baseline is 24-48 hours for critical (CVSS 9.0-10.0) vulnerabilities on critical assets, 72 hours on important assets, and 7 days on standard assets. CISA KEV-listed vulnerabilities should follow the fastest track regardless of CVSS score.

How do I handle SLA exceptions for vulnerabilities that cannot be patched?▼

Require written justification with business impact, documented compensating controls, and approval from both the asset owner and security leadership. Cap exceptions at 90 days with re-approval required for renewal, and track them in your vulnerability management platform.

What KPIs should a vulnerability management program track?▼

Track SLA compliance rate (target above 90%), mean time to remediate by severity, percentage of vulnerabilities past SLA, exception rate below 10%, and recurrence rate below 5%. Report trends monthly to executive leadership.

Why do vulnerability SLA programs fail?▼

Programs fail when SLAs are unrealistic, lack executive enforcement, treat all assets equally without tiering, or ignore threat context like EPSS and KEV. Missing exception processes also lead to untracked risk acceptance.

Related Skills

Explore More Software Engineering Skills→
jaskaranhundaljaskaranhundal
3

zero-day-response

Coordinate compensating controls for zero-day vulnerabilities lacking vendor patches.

Community
Advanced
UnitOneAIUnitOneAI
44

patch-prioritization

Prioritize vulnerability remediation patches using SSVC 2.1, EPSS v3, and CISA KEV.

Official
Intermediate
VulnetixVulnetix
9

exploits

Identify and summarize exploit intelligence for repository dependencies.

Official
Advanced
AradotsoAradotso
2

agentic-soc-platform

Ingest security alerts into a unified ASP pipeline for automated processing.

Official
Advanced