I was wondering if there are any general recommendations on maximum resolution times for vulnerabilities.
Consider a vulnerability/patch management process where a ticket is opened when a vulnerability is reported/detected. The ticket system sets a maximum resolution time based on details of the vulnerability, such as:
- Criticality of the vulnerability—critical vulnerability result in a higher risk, thus organizations cannot afford to remain vulnerable for long,
- Availability of a solution—vendor-reported vulnerabilities typically come with a solution in the form of a patch, while other cases may require a thorough (and potentially time-consuming) analysis.
If it is anticipated that a solution will not be available within the resolution time, mitigating measures need to be discussed. If the resolution time is exceeded, the ticket is escalated (resulting in an extension of the solution time and/or additional mitigating measures).
Are there any general recommendations on what the resolution times should be, or how to quantify them?