What it does. Design a vulnerability remediation SLA program covering asset tiering, Part of mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (mukul975/Anthropic-Cybersecurity-Skills).

Upstream	mukul975/Anthropic-Cybersecurity-Skills
Skill file	skills/implementing-vulnerability-remediation-sla/SKILL.md
License	Apache-2.0 (skill folder LICENSE)
Author	mukul975
Fetched	2026-09-10

Install

• npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill implementing-vulnerability-remediation-sla, or copy the skill folder into ~/.claude/skills/implementing-vulnerability-remediation-sla/.
• Raw file: curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-vulnerability-remediation-sla/SKILL.md

SKILL.md (verbatim)

name: implementing-vulnerability-remediation-sla
description: Design a vulnerability remediation SLA program covering asset tiering,
  a severity-based SLA matrix, exception processes, escalation chains, ticketing-system
  integration, and remediation KPIs/trending metrics. Use when defining mandatory
  patching timeframes by severity and asset criticality, building an SLA policy document,
  or setting up escalation and KPI tracking for vulnerability remediation.
domain: cybersecurity
subdomain: vulnerability-management
tags:
- vulnerability-management
- cve
- sla
- remediation
- patch-management
- risk
version: '1.0'
author: mahipal
license: Apache-2.0
nist_csf:
- ID.RA-01
- ID.RA-02
- ID.IM-02
- ID.RA-06
mitre_attack:
- T1190
- T1203
- T1068

Implementing Vulnerability Remediation SLA

Overview

Vulnerability remediation SLAs define mandatory timeframes for patching or mitigating identified vulnerabilities based on severity, asset criticality, and exploit availability. Effective SLA programs drive accountability, ensure consistent remediation timelines, and provide measurable KPIs for vulnerability management maturity.

When to Use

• When deploying or configuring implementing vulnerability remediation sla capabilities in your environment
• When establishing security controls aligned to compliance requirements
• When building or improving security architecture for this domain
• When conducting security assessments that require this implementation

Prerequisites

• Vulnerability scanning program producing regular findings
• Asset inventory with criticality classifications
• Ticketing system (Jira, ServiceNow, etc.) for remediation tracking
• Executive sponsorship for SLA enforcement
• Cross-functional agreement from IT operations, development, and security

Core Concepts

SLA Framework Components

1. Severity Classification: CVSS base score + threat context (EPSS, KEV)
2. Asset Tiering: Business criticality and exposure level
3. Remediation Timeframes: Maximum days to remediate by category
4. Exception Process: Documented approval for SLA extensions
5. Escalation Procedures: Actions when SLAs are breached
6. Metrics and Reporting: KPIs for compliance tracking

Recommended SLA Matrix

Severity	Tier 1 (Critical)	Tier 2 (Important)	Tier 3 (Standard)
Critical (CVSS 9.0-10.0)	24-48 hours	72 hours	7 days
High (CVSS 7.0-8.9)	7 days	14 days	30 days
Medium (CVSS 4.0-6.9)	30 days	45 days	60 days
Low (CVSS 0.1-3.9)	90 days	90 days	90 days
CISA KEV Listed	24 hours	48 hours	7 days

SLA Accelerators (Reduce SLA by 50%)

• Exploit code publicly available
• Active exploitation observed in the wild (CISA KEV)
• Internet-facing asset affected
• EPSS score > 0.5 (50% exploitation probability)
• Previous breach via similar vulnerability type

Workflow

Step 1: Define Asset Tiers

Tier 1 (Critical Assets):
- Customer-facing production systems
- Payment processing infrastructure
- Domain controllers and identity systems
- Core network infrastructure (firewalls, routers)
- Databases containing PII/PHI/PCI data

Tier 2 (Important Assets):
- Internal production applications
- Email and collaboration systems
- Development/staging environments with production data
- Backup and recovery infrastructure
- VPN and remote access gateways

Tier 3 (Standard Assets):
- End-user workstations
- Development/test environments
- Print servers and peripheral management
- Non-critical internal tools

Step 2: Establish SLA Policy Document

Key sections to include:

• Purpose and scope
• Roles and responsibilities (RACI matrix)
• Severity definitions and calculation method
• Remediation timeframes by severity and asset tier
• Exception request process and approval authority
• Escalation procedures for SLA breaches
• Metrics, reporting cadence, and governance
• Policy review and update schedule

Step 3: Integrate with Ticketing System

# ServiceNow / Jira integration for automatic ticket creation
# See process.py for full implementation

# Key fields for remediation tickets:
# - Vulnerability ID (CVE/Plugin ID)
# - Affected host(s)
# - Severity (CVSS + contextual factors)
# - Asset tier
# - SLA deadline (calculated from discovery date)
# - Assignment group
# - Remediation instructions
# - Verification criteria

Step 4: Configure Escalation Chain

SLA Status          Action                          Notify
───────────────────────────────────────────────────────────
75% elapsed         Warning email                   Asset owner
100% elapsed        SLA breach notification          Manager + CISO
100% + 7 days       Executive escalation             VP/CTO
100% + 30 days      Risk acceptance required          CISO approval
100% + 90 days      Compensating controls mandatory   Board report

Step 5: Establish Exception Process

Valid exception reasons:

• System cannot be patched without major downtime (scheduled maintenance window)
• No vendor patch available (apply compensating controls)
• Patch breaks critical functionality (require test results as evidence)
• End-of-life system pending decommission (document risk acceptance)

Exception requirements:

• Written justification with business impact
• Compensating controls documented and implemented
• Approved by asset owner AND security leadership
• Maximum exception duration: 90 days (renewable with re-approval)
• Tracked in vulnerability management platform

Key Performance Indicators (KPIs)

Primary Metrics

KPI	Definition	Target
SLA Compliance Rate	% of vulns remediated within SLA	>90%
Mean Time to Remediate (MTTR)	Average days from discovery to fix	Critical: <3d, High: <10d
Vulnerability Backlog	Open vulnerabilities past SLA	<5% of total
Exception Rate	% of findings with active exceptions	<10%
Recurrence Rate	% of vulns that reappear after remediation	<5%

Trending Metrics

• Month-over-month SLA compliance trend
• MTTR trend by severity
• Vulnerability density per asset (vulns/host)
• Patch coverage rate (% of assets scanned and compliant)
• Time to first response (acknowledgment of finding)

Best Practices

1. Start with achievable SLAs and tighten over time as maturity improves
2. Use automated ticketing to eliminate manual SLA tracking
3. Provide remediation teams with clear fix instructions, not just CVE numbers
4. Track SLA compliance at the team/department level for accountability
5. Report SLA metrics to executive leadership monthly
6. Include compensating controls as valid interim remediation
7. Align SLAs with regulatory requirements (PCI DSS, HIPAA, SOX)
8. Review and adjust SLAs annually based on threat landscape changes

Common Pitfalls

• Setting unrealistic SLAs that teams cannot meet (creates SLA fatigue)
• No executive enforcement of SLA breaches
• Treating all assets equally without tiering
• Not accounting for vulnerability context (EPSS, KEV) in SLA calculation
• Missing exception management process (leads to untracked risk)
• Measuring only compliance rate without analyzing root causes of breaches

Related Skills

• prioritizing-vulnerabilities-with-cvss-scoring
• implementing-patch-management-workflow
• implementing-vulnerability-metrics-and-reporting
• implementing-exception-management-process

Other files in this skill

• LICENSE
• assets/template.md
• references/api-reference.md
• references/standards.md
• references/workflows.md
• scripts/agent.py
• scripts/process.py

assets/template.md (verbatim)

Vulnerability Remediation SLA Policy Template

1. Purpose

This policy defines mandatory timeframes for remediating identified vulnerabilities based on severity and asset criticality.

2. SLA Matrix

Severity	Tier 1	Tier 2	Tier 3
Critical	48h	72h	7 days
High	7 days	14 days	30 days
Medium	30 days	45 days	60 days
Low	90 days	90 days	90 days

3. Escalation Procedure

Threshold	Action	Notification
75% elapsed	Warning	Asset Owner
SLA breach	Escalation L1	Manager + Security
Breach + 7d	Escalation L2	Director
Breach + 30d	Risk Acceptance	CISO

4. Exception Process

• Requestor: [Asset owner name]
• Justification: [Reason for exception]
• Compensating Controls: [Mitigations in place]
• New Deadline: [Extended date]
• Approved By: [Security leadership]

5. Monthly Compliance Report

Metric	This Month	Last Month	Trend
Compliance Rate	[%]	[%]	[arrow]
MTTR (Critical)	[N days]	[N days]	[arrow]
Open Breaches	[N]	[N]	[arrow]

references/api-reference.md (verbatim)

API Reference: Vulnerability Remediation SLA Tracking

Libraries Used

Library	Purpose
requests	Fetch vulnerability data from scanner APIs
json	Parse vulnerability and asset data
datetime	Calculate SLA deadlines, time-to-remediation
csv	Export SLA compliance reports

Installation

pip install requests

SLA Tiers

Severity	CVSS Range	SLA Deadline	Description
Critical	9.0 - 10.0	24 hours	Actively exploited or trivially exploitable
High	7.0 - 8.9	72 hours	Remote code execution, privilege escalation
Medium	4.0 - 6.9	30 days	Requires user interaction or local access
Low	0.1 - 3.9	90 days	Informational, minimal impact

Core Operations

Define SLA Configuration

from datetime import datetime, timedelta

SLA_TIERS = {
    "critical": timedelta(hours=24),
    "high": timedelta(hours=72),
    "medium": timedelta(days=30),
    "low": timedelta(days=90),
}

def get_sla_deadline(severity, discovery_date):
    tier = severity.lower()
    sla_window = SLA_TIERS.get(tier, timedelta(days=90))
    return discovery_date + sla_window

Calculate SLA Status for a Vulnerability

def calculate_sla_status(vuln):
    discovery = datetime.fromisoformat(vuln["discovery_date"])
    deadline = get_sla_deadline(vuln["severity"], discovery)
    now = datetime.now()

    if vuln.get("remediated_date"):
        remediated = datetime.fromisoformat(vuln["remediated_date"])
        return {
            "cve": vuln["cve"],
            "status": "remediated",
            "met_sla": remediated <= deadline,
            "time_to_remediate_hours": (remediated - discovery).total_seconds() / 3600,
        }

    overdue = now > deadline
    hours_remaining = (deadline - now).total_seconds() / 3600 if not overdue else 0
    hours_overdue = (now - deadline).total_seconds() / 3600 if overdue else 0

    return {
        "cve": vuln["cve"],
        "status": "overdue" if overdue else "open",
        "severity": vuln["severity"],
        "deadline": deadline.isoformat(),
        "hours_remaining": round(hours_remaining, 1),
        "hours_overdue": round(hours_overdue, 1),
    }

Fetch Vulnerabilities from Tenable

import requests
import os

TENABLE_URL = "https://cloud.tenable.com"
headers = {
    "X-ApiKeys": f"accessKey={os.environ['TENABLE_ACCESS_KEY']};secretKey={os.environ['TENABLE_SECRET_KEY']}",
}

def get_open_vulnerabilities():
    resp = requests.get(
        f"{TENABLE_URL}/workbenches/vulnerabilities",
        headers=headers,
        params={"date_range": 90, "filter.0.filter": "severity", "filter.0.value": "4,3"},
        timeout=60,
    )
    resp.raise_for_status()
    return resp.json().get("vulnerabilities", [])

Generate SLA Compliance Report

def generate_sla_report(vulnerabilities):
    report = {
        "total": len(vulnerabilities),
        "by_status": {"open": 0, "overdue": 0, "remediated": 0},
        "by_severity": {"critical": 0, "high": 0, "medium": 0, "low": 0},
        "sla_compliance_rate": 0.0,
        "overdue_vulns": [],
        "mean_time_to_remediate": {},
    }

    remediated_times = {"critical": [], "high": [], "medium": [], "low": []}

    for vuln in vulnerabilities:
        status = calculate_sla_status(vuln)
        report["by_status"][status["status"]] += 1
        report["by_severity"][vuln["severity"].lower()] += 1

        if status["status"] == "overdue":
            report["overdue_vulns"].append(status)
        if status["status"] == "remediated":
            sev = vuln["severity"].lower()
            remediated_times[sev].append(status["time_to_remediate_hours"])

    total_with_deadline = report["by_status"]["remediated"] + report["by_status"]["overdue"]
    if total_with_deadline > 0:
        met_sla = sum(1 for v in vulnerabilities
                      if calculate_sla_status(v).get("met_sla", False))
        report["sla_compliance_rate"] = round(met_sla / total_with_deadline * 100, 1)

    for sev, times in remediated_times.items():
        if times:
            report["mean_time_to_remediate"][sev] = round(sum(times) / len(times), 1)

    return report

Output Format

{
  "report_date": "2025-01-15",
  "total": 245,
  "by_status": {"open": 180, "overdue": 23, "remediated": 42},
  "by_severity": {"critical": 5, "high": 28, "medium": 112, "low": 100},
  "sla_compliance_rate": 87.5,
  "mean_time_to_remediate": {
    "critical": 18.5,
    "high": 52.3,
    "medium": 480.0,
    "low": 1200.0
  },
  "overdue_vulns": [
    {
      "cve": "CVE-2024-21887",
      "severity": "critical",
      "hours_overdue": 48.5,
      "deadline": "2025-01-13T10:00:00"
    }
  ]
}

references/standards.md (verbatim)

Standards and References - Vulnerability Remediation SLA

Regulatory SLA Requirements

• PCI DSS v4.0 Req 6.3.3: Address vulnerabilities by risk ranking (critical/high within 30 days)
• CISA BOD 22-01: Federal agencies must remediate KEV within specified timeframes
• NIST SP 800-40 Rev 4: Enterprise Patch Management Planning
• SOX: Timely remediation of IT control deficiencies
• HIPAA: Reasonable and appropriate security measures including patching

Industry Benchmarks

Severity	CISA BOD 22-01	PCI DSS	CIS Benchmark	Best Practice
Critical	14 days (KEV)	30 days	48 hours	24-48 hours
High	N/A	30 days	7 days	7-14 days
Medium	N/A	90 days	30 days	30 days
Low	N/A	Next cycle	90 days	90 days

KPI Benchmarks (Industry Average)

Metric	Average	Top Quartile	Best in Class
SLA Compliance	65%	85%	>95%
MTTR (Critical)	15 days	5 days	<2 days
MTTR (High)	30 days	14 days	<7 days
Vuln Backlog	25%	10%	<5%

references/workflows.md (verbatim)

Workflows - Vulnerability Remediation SLA

Workflow 1: SLA Assignment and Tracking

Vulnerability Discovered
    │
    ├──> Determine Severity (CVSS + EPSS + KEV)
    ├──> Determine Asset Tier (CMDB lookup)
    ├──> Calculate SLA Deadline
    │
    ├──> Create Remediation Ticket (Auto)
    │       ├──> Assign to responsible team
    │       ├──> Set SLA deadline
    │       └──> Include remediation instructions
    │
    ├──> Monitor Progress
    │       ├──> 50% elapsed: Status check
    │       ├──> 75% elapsed: Warning notification
    │       └──> 100% elapsed: Breach escalation
    │
    └──> Verify Remediation
            ├──> Re-scan target
            ├──> Confirm vulnerability resolved
            └──> Close ticket

Workflow 2: SLA Breach Escalation

SLA Breached (100% elapsed)
    │
    ├──> Day 0: Auto-notify asset owner + manager
    ├──> Day 7: Escalate to department head
    ├──> Day 14: Escalate to CISO
    ├──> Day 30: Require formal risk acceptance
    └──> Day 90: Report to executive committee

Workflow 3: Exception Management

Exception Request Submitted
    │
    ├──> Validate justification
    ├──> Verify compensating controls
    ├──> Risk assessment review
    │
    ├──> Approved → Set new deadline, document in system
    └──> Denied → Original SLA enforced, escalate

Back to mukul975/Anthropic-Cybersecurity-Skills (817 security skills) or Agent skills.