OSS
/oss/en/openforge/standards/vulnerability-management

Vulnerability Management

CVE triage procedures, risk prioritization, patching workflows, and SLA.

Vulnerability Management

Vulnerability management is a continuous lifecycle process rather than a point-in-time check.

Governance Rules

  • Scheduled Scanning: Continuous scans across third-party dependencies and container base images.
  • Remediation SLAs:
    • Critical: Patch release within 48 hours
    • High: Patch release within 7 days
    • Medium/Low: Remediation in next scheduled minor release
  • Documented Waivers: False positives documented with technical rationale and expiration dates.

Canonical Source