IDENTIFY ANALYZE ASSESS ADDRESS

vulnerabilities the actual risk to vulnerability the vulnerabilities

through scanning the organization remediation through planning
tool and external based on your options with risk- and remediation
sources security posture based approach action
 Start

Vulnerability has
been identified

Are we running the Are we running the Vulnerability

Is the vulnerable element
associated product of YES associated version of YES YES has been End
in use?
software? software? triaged

NO
NO NO

No action
needed
 Vulnerability has been
triaged and prioritized

Identify remediation
options: patches,
configuration changes,
compensating controls, or
risk acceptance

Route remediation Continually improve

activities through the remediation
release and change process
management
processes

Remediation action
NO
successful?

YES

Verify that the remediation

took place for all affected
systems/applications

Document the remediation

process for each
vulnerability