Simple explanation
Finding and prioritizing a vulnerability is only half the job — this lesson covers what happens next: how it actually gets fixed, tracked, and governed as an ongoing program.
Technical explanation
- Control types: compensating controls (an alternative safeguard when the direct fix isn't immediately possible) and mitigating controls (reduce impact/likelihood without fully eliminating the vulnerability).
- Patching and configuration management — the direct fix, and the ongoing discipline of keeping systems at an approved, current configuration.
- Maintenance windows — pre-approved time periods during which changes (including patches) are permitted, balancing security urgency against operational disruption.
- Exceptions — a formally documented, approved deviation from normal patching/remediation requirements, with a defined justification and (ideally) an expiration or review date.
- Risk management principles — every vulnerability response decision ultimately ties back to risk: accept, transfer, avoid, or mitigate.
- Policies/governance — the organizational rules defining acceptable remediation timelines by severity, who approves exceptions, and how the whole program is overseen.
- SLA (Service Level Agreement) for patching — a committed timeframe (e.g., "critical vulnerabilities patched within 15 days") with accountability attached.
- Prioritization/escalation — routing findings to the right owner with appropriate urgency, and escalating when remediation stalls past its committed timeline.
Synonyms / related terms
| Term | Means | |---|---| | Compensating control | Alternative safeguard when the direct fix isn't feasible | | Patching SLA | Committed remediation timeframe by severity | | Exception | Formally approved deviation from normal remediation requirements |
Concept Check
"A critical vulnerability can't be patched for six weeks due to a vendor dependency. The security team documents this, gets management approval, and applies a WAF rule blocking the specific attack pattern in the meantime." This is a textbook compensating control paired with a formal exception — not negligence, and not simply "ignoring" the vulnerability; the risk is actively being managed even though the ideal fix is delayed.
Interview-style Q&A
Q: Why do organizations set different patching SLAs by severity instead of one blanket timeline for everything? A: "Because treating every finding with the same urgency either wastes resources on low-risk items or lets high-risk items linger too long. A tiered SLA — say 15 days for critical, 30 for high, 90 for medium — lets the team focus urgency where it actually matters, while still guaranteeing everything gets addressed eventually."
Memory trick
"Fix it, Compensate, Document the Exception, Track the SLA" — the four-step response lifecycle once a vulnerability has been prioritized and assigned.