<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: managing-vulnerability-remediation-slas
description: >-
  Define, enforce, and track vulnerability remediation SLAs by severity tier
  with automated escalation, exception workflows, and compliance reporting
  across business units.
domain: cybersecurity
subdomain: vulnerability-management
tags:
  - remediation-sla
  - vulnerability-management
  - sla-compliance
  - escalation
  - metrics
  - mttr
  - risk-management
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: []
---

# Managing Vulnerability Remediation SLAs

## Overview

Remediation SLAs translate vulnerability severity into time-bound remediation
commitments. Without enforcement, critical vulnerabilities linger for months.
This skill covers SLA definition, automated tracking, escalation workflows,
exception management, and executive reporting on SLA compliance by business unit.

Mode: `[MODE: BLUE]` — Operational vulnerability management and compliance.

## Prerequisites

- Vulnerability management platform (Tenable, Qualys, Rapid7, or DefectDojo)
- Ticketing integration (Jira, ServiceNow) for remediation tracking
- Python 3.10+ with `requests`
- Access to vulnerability scan data in JSON format

## Key Concepts

### SLA Tiers

| Severity | SLA Target | Escalation at 75% | Escalation at 100% | Max Exception |
|----------|-----------|-------------------|--------------------|--------------  |
| Critical | 48 hours | 36h → Team Lead | 48h → CISO | 7 days |
| High | 7 days | 5d → Manager | 7d → Director | 30 days |
| Medium | 30 days | 22d → Team Lead | 30d → Manager | 90 days |
| Low | 90 days | 67d → Team Lead | 90d → Manager | 180 days |

### SLA Calculation

```bash
# Calculate SLA compliance from vulnerability data
# SLA start: scan discovery timestamp
# SLA end: verified remediation timestamp (rescan confirmation)
# SLA clock stops: approved exception with compensating control

# MTTR calculation
# Mean Time to Remediate = avg(remediation_date - discovery_date) by severity

# Example: Query Tenable.io for overdue vulnerabilities
curl -s "https://cloud.tenable.com/workbenches/vulnerabilities" \
  -H "X-ApiKeys: accessKey=$AK; secretKey=$SK" | \
  jq '[.vulnerabilities[] | select(.severity >= 3)] |
      map({plugin_name, severity, first_found: .discovery.seen_first}) |
      sort_by(.severity) | reverse'
```

### Escalation Automation

```bash
# Jira escalation — create ticket for overdue critical vuln
curl -s -X POST "https://jira.internal/rest/api/2/issue" \
  -H "Authorization: Bearer $JIRA_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "fields": {
      "project": {"key": "VULN"},
      "summary": "OVERDUE: CVE-2024-6387 — Critical SLA breach",
      "issuetype": {"name": "Bug"},
      "priority": {"name": "Critical"},
      "assignee": {"name": "system_owner"},
      "labels": ["sla-breach", "auto-escalated"]
    }
  }'
```

## Workflow

### Step 1: Import Vulnerability Data

```bash
node scripts/agent.js --action import \
  --input /tmp/scan_results.json \
  --output /tmp/sla_tracking.json
```

### Step 2: Calculate SLA Status

```bash
node scripts/agent.js --action check-sla \
  --input /tmp/sla_tracking.json \
  --output /tmp/sla_report.json
```

### Step 3: Generate Compliance Report

```bash
node scripts/agent.js --action report \
  --input /tmp/sla_report.json \
  --output /tmp/sla_compliance.json
```

### Step 4: Review Breaches

```bash
cat /tmp/sla_compliance.json | jq '.findings[] | select(.sla_status == "breached")'
```

## Verification

- [ ] SLA tiers defined and approved by security leadership
- [ ] Automated escalation triggers configured at 75% and 100% thresholds
- [ ] MTTR tracked by severity and business unit
- [ ] Exception process requires documented compensating controls
- [ ] Weekly SLA compliance dashboard published to stakeholders
- [ ] SLA clock pauses only for approved exceptions

## References

- [CIS Controls v8 — Control 7.4: Perform Automated Patch Management](https://www.cisecurity.org/controls)
- [NIST SP 800-40 Rev 4 — Guide to Enterprise Patch Management](https://csrc.nist.gov/publications/detail/sp/800-40/rev-4/final)
- [CISA BOD 22-01 — Reducing Significant Risk of Known Exploited Vulnerabilities](https://www.cisa.gov/binding-operational-directive-22-01)
