Vulnerability Management

Vulnerability management is a continuous lifecycle process rather than a point-in-time check.

Governance Rules

• Scheduled Scanning: Continuous scans across third-party dependencies and container base images.
• Remediation SLAs:
  • Critical: Patch release within 48 hours
  • High: Patch release within 7 days
  • Medium/Low: Remediation in next scheduled minor release
• Documented Waivers: False positives documented with technical rationale and expiration dates.

Canonical Source

• Vulnerability Management