A company is evaluating its current information security posture. The CISO receives a report detailing that the organization has a low maturity level in its vulnerability management program, with many identified vulnerabilities remaining unpatched for extended periods. This indicates a weakness in which of the following core information security concepts?

Why the other options are wrong

• A. Confidentiality is about preventing unauthorized disclosure of information. While unpatched vulnerabilities could lead to data disclosure, the direct impact of a vulnerability is often data alteration or system corruption, which is integrity.
• B. Availability is ensuring that systems and data are accessible to authorized users when needed. While an exploit of a vulnerability could lead to denial of service, the presence of the vulnerability itself more fundamentally threatens the correctness of data and systems.
• D. Timeliness is a characteristic related to data being available when needed, or actions being performed promptly, but it's not one of the core CIA triad principles in the same way as confidentiality, integrity, and availability. Vulnerability management timeliness is about patching, but the core security concept being weakened by unpatched vulnerabilities is integrity.