RA.L2-3.11.3—Vulnerability Remediation
Level 2
800-171: 3.11.3
>Control Description
Remediate vulnerabilities in accordance with risk assessments.
>Cross-Framework Mappings
>Assessment Interview Topics
Questions assessors commonly ask
Process & Governance:
- •What is your vulnerability remediation policy?
- •How do you prioritize vulnerabilities for remediation?
- •What are your target timeframes for remediating different severity vulnerabilities?
- •Who is responsible for tracking and ensuring vulnerability remediation?
- •What is your process for handling vulnerabilities that cannot be immediately remediated?
- •How do you verify that vulnerabilities have been successfully remediated?
Technical Implementation:
- •What patch management tools deploy vulnerability fixes?
- •What ticketing systems track vulnerability remediation?
- •What tools verify vulnerabilities have been remediated?
- •What compensating controls are used when remediation is not possible?
- •What rescanning verifies successful remediation?
- •What dashboards track remediation progress?
Evidence & Documentation:
- •What risk assessment reports and documentation can you provide?
- •What risk assessment methodology documentation shows your approach?
- •What vulnerability scan reports demonstrate regular scanning?
- •What vulnerability remediation tracking shows timely remediation?
- •What risk register or risk tracking documentation can you show?
- •What evidence demonstrates risk assessments are conducted periodically?
Ask AI
Configure your API key to use AI features.