Vulnerability remediation: from scan report to closed ticket

Reference article · 5 min read

A vulnerability scan produces a document, not a plan. A long export from an authenticated scan repeats the same missing patch once per host, describes one flaw across several entries, and lists findings on systems another department or an outside vendor controls. The distance between receiving that file and closing the last ticket is where remediation programs stall.

Closing that distance is organizational work: collapsing rows into units of work, deciding the order, finding the person with the credentials and the change window, and writing down what you have decided not to fix. It takes a process that survives staff turnover and that you can show an auditor without apologizing for it.

Collapse the report into units of work

Scanner output is organized by host and plugin. Remediation happens by fix action, and the first pass over any export converts one into the other.

• Group by fix, not by finding. One cumulative operating system update or runtime removal often clears hundreds of rows. Sort by remediation step, then count affected hosts.
• Remove what is not real. Decommissioned assets, one host scanned through two addresses, and load balancer findings that do not reflect the backend all inflate the total.
• Reconcile against the asset inventory. A finding on a device not in your inventory is two problems. Track the inventory gap separately so it does not disappear inside the patching queue.
• Keep the raw export. Archive each scan file unchanged, with its date and scope, before anyone edits it, so you can later show when a condition was first detected.

Prioritize by exploitation and exposure, not raw score

A CVSS base score describes a flaw in the abstract. It does not know whether the host is reachable from the internet, whether anyone is exploiting the vulnerability today, or whether a compensating control blocks the path. Use it as one input, not as the queue order.

• Known exploited vulnerabilities first. CISA publishes the Known Exploited Vulnerabilities catalog, a public list of CVEs with evidence of active exploitation. Federal directives requiring remediation of catalog entries bind federal civilian agencies, not state and local governments, but the catalog is free and many agencies use it as a prioritization trigger. Some state policies and grant conditions reference it, so confirm what applies to you.
• Internet exposure. Separate externally reachable assets from internal ones in every view. A high-severity finding on a public web server usually outranks a critical finding on an isolated workstation.
• Exploitation likelihood. The Exploit Prediction Scoring System, published by FIRST, estimates the probability that a vulnerability will be exploited in the near term, which helps rank the middle of the queue.
• Mission criticality. Dispatch, jail management, utility control systems, and payroll deserve their own tier regardless of scanner score.

Set deadlines you can defend

Put remediation service levels in written policy, not in a project plan, and state them as clocks. Define when the clock starts, usually at validation rather than scan date. Pick intervals your teams can actually meet: a deadline that is usually met is more defensible than an aggressive one that is routinely missed. Use tighter clocks for internet-facing assets and for anything on the known exploited list, and write down the escalation path for a missed deadline.

Route each item to someone who can act

• Internal owners by platform. Assign by the team holding the credentials: server, network, endpoint, database, application. Equipment a department bought on its own needs an owner assigned by management, not by the security team.
• Vendor-managed systems. Hosted applications and managed appliances need a ticket against the vendor on the same clock, tracked in your system rather than only in theirs.
• Operational technology. Water and wastewater controls, traffic equipment, and building systems often need vendor-certified patches and scheduled outages, so plan them on a longer cycle with documented interim controls.
• One ticket per fix action. Use the service management system the agency already runs, linked to finding identifiers, so remediation appears in normal change reporting.

Track risk acceptances as signed decisions

Some findings will not be fixed on schedule. Treat that as a decision with a name attached, not an item that quietly ages out of the report. Record the finding, the affected assets, the reason, and the compensating controls. Require approval at a level matching the risk, with higher tiers signed by a department head or the CIO. Give every acceptance an expiration date, and keep one register you review each cycle.

Report differently to each audience

A steering committee does not need finding counts. Show open critical and high items past deadline, aging by bucket, the trend across recent scan cycles, where work is blocked and who owns it, and the number of active risk acceptances. Keep the same measures every time so the trend means something.

A grant sub-recipient monitor is asking whether funded activity happened as approved. Federal awards carry subrecipient monitoring requirements under the Uniform Guidance, and each pass-through entity adds its own formats. If scanning or remediation was grant funded, keep scan dates and scope, remediation evidence, procurement records, and progress against the approved project narrative. Requirements change between cycles, so confirm current expectations with your state administering agency.

What to require of vendors

When a vendor operates or hosts the system, remediation is a contract question. Ask for the patch and vulnerability management process in writing during evaluation, then put what you rely on into the agreement: remediation timeframes by defined severity, notification when a product is affected by a listed known exploited vulnerability, the right to scan or to receive authenticated results, evidence you can hand to an auditor, and end-of-support dates for the versions you are buying.

HQT supports state and local agencies on vulnerability management workflow and remediation tracking.

Frequently asked questions