# yaml-language-server: $schema=../../../../schema/control.schema.json
id: CB-DEP-VULN-003
title: Fix vulnerable dependencies within set deadlines
finding:
  title: Vulnerable dependencies stay in production indefinitely
status: draft
profiles: [baseline]
risk:
  severity: high
assessment: manual
tags: [vulnerability, sla]
description: |
  Vulnerable dependencies are fixed, mitigated or formally accepted within a deadline that depends on severity: {{ sla_critical_days }} days for critical, {{ sla_high_days }} days for high, {{ sla_medium_days }} days for medium. Vulnerabilities listed as exploited in the wild, or with a high exploitation probability, are handled first.
rationale: |
  Detection without a deadline produces backlogs. Prioritizing by known exploitation focuses effort on the small share of vulnerabilities attackers actually use.
impact: |
  Teams must reserve time for dependency fixes.
notes: |
  A vulnerability in code that is not reachable may be accepted, with the analysis recorded and reviewed at the next release.
parameters:
  - name: sla_critical_days
    type: integer
    description: Deadline for critical vulnerabilities.
    unit: days
    default: 7
    profile_defaults:
      hardened: 2
    minimum: 1
    maximum: 30
  - name: sla_high_days
    type: integer
    description: Deadline for high vulnerabilities.
    unit: days
    default: 30
    profile_defaults:
      hardened: 14
    minimum: 1
    maximum: 90
  - name: sla_medium_days
    type: integer
    description: Deadline for medium vulnerabilities.
    unit: days
    default: 90
    profile_defaults:
      hardened: 60
    minimum: 1
    maximum: 365
audit:
  manual: |
    1. Check that deadlines are defined and known to teams.
    2. List open dependency vulnerabilities and check none is past its deadline without a recorded acceptance.
remediation:
  manual: |
    1. Publish the deadlines.
    2. Track open findings with their due date and report overdue ones.
references:
  - title: Known Exploited Vulnerabilities Catalog
    url: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
    publisher: CISA
    kind: other
    accessed: 2026-10-16
  - title: Exploit Prediction Scoring System (EPSS)
    url: https://www.first.org/epss/
    publisher: FIRST
    kind: standard
    accessed: 2026-10-16
  - title: NIST SP 800-218 - Secure Software Development Framework (SSDF) 1.1
    url: https://csrc.nist.gov/pubs/sp/800/218/final
    publisher: NIST
    kind: standard
    accessed: 2026-10-16
mappings:
  - framework: nist-800-53r5
    framework_version: 5.1.1
    id: SI-2
    relation: related
  - framework: nist-800-53r5
    framework_version: 5.1.1
    id: RA-5
    relation: related
  - framework: iso27001-2022
    framework_version: '2022'
    id: A.8.8
    relation: related
threats:
  - framework: cwe
    id: CWE-1395
related_controls:
  - id: CB-DEP-VULN-001
    type: related
authors:
  - name: Alice
    github: Sn0wAlice
introduced_in: 1.0.0
created: 2026-10-16
updated: 2026-10-16