Configure Remediation SLAs

For each CVE on the Vulnerabilities view, you can see the status and deadline. These remediation deadlines and remediation statuses such as “due soon”, “due later” and “overdue” are calculated based on the industry best practices and service-level agreements (SLAs) that prescribe different timeframes for mitigating CVEs depending on their CVSS score.

For example: 

• Critical vulnerabilities (9-10) must be addressed within a week,
• High impact vulnerabilities (7-9) must be mitigated within 15 days,
• Medium vulnerabilities (4-7) must be treated in 30 days,
• Low impact vulnerabilities (1-4) must be mitigated within 60 days. 

You can adjust SLAs based on your corporate patching policy. For example, to ensure critical issues get addressed as soon as possible, you can make them prominent by keeping their deadlines tight while loosening those for low- and medium-risk CVEs.

Adjusting Remediation SLAs

To modify SLAs for vulnerability remediation using the dashboard:

1. Open the Dashboard page and go to the Vulnerability Remediation Compliance widget.
2. Click a gear icon in the top-right corner.
3. In the Service Level Agreement dialog displayed, set remediation timeframes for each severity.

To modify SLAs using Action1 configuration settings:

1. Open the Advanced page, select SLA settings category.
2. Select the Vulnerability Remediation SLA you want to update and provide a new value.

To learn about the update deployment SLAs, see Roll Out and Deploy Updates.