CIS Control 7.1: Establish and Maintain a Vulnerability Management Process

What this means

This control mandates that you create and maintain written documentation describing how your organization identifies, categorizes, and remediates vulnerabilities across your entire asset inventory. The process must be reviewed and updated at least annually, or immediately when significant changes occur in your IT environment (new systems, acquisitions, infrastructure changes). The goal is to shift from ad-hoc vulnerability discovery to a disciplined, repeatable program that reduces mean time to remediation and minimizes your attack surface.

How to comply

1. 1.Document your vulnerability management workflow, including discovery methods, severity classification, remediation timelines, and ownership responsibilities
2. 2.Define roles and responsibilities: who identifies vulnerabilities, who prioritizes them, who remediates, and who verifies closure
3. 3.Establish service-level objectives (SLOs) for remediation based on vulnerability severity—critical vulnerabilities should have shorter timelines than low-severity issues
4. 4.Integrate vulnerability scanning tools (network scanners, application scanners, cloud assessments) into your process
5. 5.Create a system for tracking vulnerabilities from discovery through remediation and closure verification
6. 6.Schedule an annual review of your vulnerability management documentation and process effectiveness
7. 7.Update your process documentation whenever major infrastructure changes, system deployments, or organizational changes occur
8. 8.Communicate the process to all relevant teams and ensure they understand their roles and timelines

Evidence auditors look for

• Formal vulnerability management policy document with defined roles, procedures, and timelines
• Asset inventory that feeds into your vulnerability scanning scope
• Configuration of automated vulnerability scanning tools across all enterprise assets
• Vulnerability tracking log with issue ID, discovery date, severity, assigned owner, remediation plan, and closure date
• Evidence of annual process review (dated documentation updates, meeting minutes, sign-offs)
• Remediation tickets or change requests showing vulnerable systems were patched or decommissioned
• Documentation of process updates following significant enterprise changes
• SLA/SLO documentation for vulnerability remediation timelines by severity level

Frequently asked questions

GRCWatch automates vulnerability discovery across your entire asset inventory, centralizes findings in a single dashboard, tracks remediation timelines, and generates dated evidence of your annual process reviews—eliminating manual spreadsheets and documentation gaps.

See how GRCWatch handles this control automatically

Related controls