A CISA is evaluating the effectiveness of vulnerability management within an organization. The organization has a large and complex IT infrastructure with a mix of legacy systems and new cloud-native applications. Which of the following metrics is MOST indicative of a mature and effective vulnerability management program?
- AThe total number of vulnerabilities identified per month.
- BThe number of vulnerability assessment tools deployed across the environment.
- CThe percentage of critical vulnerabilities remediated within the defined service level objective (SLO).
- DThe average time taken to complete a full vulnerability scan cycle.
Show answer & explanationAnswer & explanation
Correct answer: C. The percentage of critical vulnerabilities remediated within the defined service level objective (SLO).
While identifying vulnerabilities is important, the true measure of an effective vulnerability management program is its ability to remediate the most critical threats in a timely manner. The percentage of critical vulnerabilities remediated within the defined SLO directly reflects the program's efficiency and effectiveness in reducing the highest risks to the organization, indicating maturity.
Why the other options are wrong
- A. Total vulnerabilities identified is a measure of discovery, not remediation effectiveness.
- B. The number of tools doesn't indicate effectiveness; a single well-utilized tool can be more effective than many unused ones.
- D. Scan cycle time is an operational metric, but not as indicative of overall program effectiveness as actual remediation rates.
Vulnerability Remediation Efficiency
A key metric in vulnerability management that measures the timeliness and completeness of addressing identified security weaknesses, particularly focusing on critical vulnerabilities within established service level objectives (SLOs).
- Directly reflects risk reduction.
- Indicates program maturity.
- Prioritizes high-impact vulnerabilities.
Memory trick: It's not how many bugs you find, but how many critical ones you fix, fast.