Fix vulnerable dependencies within set deadlines

Description

Vulnerable dependencies are fixed, mitigated or formally accepted within a deadline that depends on severity: {{ sla_critical_days }} days for critical, {{ sla_high_days }} days for high, {{ sla_medium_days }} days for medium. Vulnerabilities listed as exploited in the wild, or with a high exploitation probability, are handled first.

A vulnerability in code that is not reachable may be accepted, with the analysis recorded and reviewed at the next release.

Rationale

Detection without a deadline produces backlogs. Prioritizing by known exploitation focuses effort on the small share of vulnerabilities attackers actually use.

Impact

Teams must reserve time for dependency fixes.

Parameters

The value used is your override, else the profile's, else the default. Bounds limit what an override may set.

Audit

1. Check that deadlines are defined and known to teams.
2. List open dependency vulnerabilities and check none is past its deadline without a recorded acceptance.

Remediation

1. Publish the deadlines.
2. Track open findings with their due date and report overdue ones.

References

• Known Exploited Vulnerabilities Catalog CISA, other, accessed 2026-10-16
• Exploit Prediction Scoring System (EPSS) FIRST, standard, accessed 2026-10-16
• NIST SP 800-218 - Secure Software Development Framework (SSDF) 1.1 NIST, standard, accessed 2026-10-16

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-DEP-VULN-001 Scan dependencies for known vulnerabilities continuously

People and lifecycle