An organization's security team has completed a vulnerability assessment and found that 30% of critical vulnerabilities remain unpatched beyond the SLO of 30 days for critical findings. The CISO asks the analyst to identify inhibitors to remediation. Which analysis should the analyst perform?

Question

Accepted Answer

A. Review change management processes, resource constraints, patch testing delays, and vendor support gaps that delay remediation beyond SLO. Inhibitors to remediation are factors that prevent timely vulnerability remediation including: bureaucratic change management overhead, insufficient patching resources, long patch testing cycles in staging, and lack of vendor support for legacy systems. The CySA+ Reporting and Communication domain explicitly identifies inhibitors to remediation as a key component of vulnerability management reporting. The analysis must identify root causes, not just metrics.

An organization's security team has completed a vulnerability assessment and found that 30% of critical vulnerabilities remain unpatched beyond the SLO of 30 days for critical findings. The CISO asks the analyst to identify inhibitors to remediation. Which analysis should the analyst perform?

Related Questions

Discussion