Remediation policy and SLAs

The remediation policy (stored as a triage policy) says how long a finding of each severity may stay open, and how long it may wait for a triage decision. Set it on Configuration › Remediation Policy (/resolve/triage-policy).

An organisation with no policy is not graded leniently: it is graded as having none, and every report below says so.

What grades against it

Report	Resolve Platform page	Uses
Exposure and remediation performance	/resolve/exposure	MTTR and overdue findings against the windows
PCI DSS	/resolve/pci-dss	Requirements 6.3.1 and 11.3.1 cite the windows and the triage threshold
ISO/IEC 27001:2022	/resolve/iso-27001	Control A.8.8 quotes them as the vulnerability management SLA
EU Cyber Resilience Act	/resolve/eu-cra	Remediation cadence
Campaigns	/resolve/campaigns	A campaign deadline can be derived from the policy (deadlineSource: policy)

Fields

Field	Resolve Platform label	Range	Meaning
criticalRemediationDays, highRemediationDays, mediumRemediationDays, lowRemediationDays	Remediation window	1 to 3650 days	How long a finding of that severity may stay open
criticalThresholdAllowance, highThresholdAllowance, mediumThresholdAllowance, lowThresholdAllowance	Grace allowance	0 to 3650 days	Extra days before the finding counts as breached. 0 holds the window exactly.
triageThresholdDays	Triage threshold	1 to 3650 days	How long a finding may wait for a triage decision
exposureWindowDays	Exposure window	1 to 3650 days	The period the exposure views measure over
threatWindowDays	Threat window	1 to 3650 days	The period the threat views measure over
severityHighThreshold, severityMediumThreshold, severityLowThreshold	High, Medium, Low at or above	CVSS 0 to 10, strictly increasing low < medium < high	Severity band cut points. Critical starts at 9.0.
name, description			name defaults to “Remediation policy”

The console’s If a finding opens today panel shows the breach date for each band and the triage-by date under the numbers in the editor.

Errors and warnings

A save with any of these is 400 {"error":"invalid policy","errors":[...]}: a day count outside its range, a severity threshold outside 0 to 10, or thresholds not increasing.

These are warnings, returned in warnings with a successful save, because the policy is yours to declare:

• “remediation windows do not widen as severity falls”: a critical window longer than high, high longer than medium, or medium longer than low. Usually two transposed fields.
• “the triage threshold is longer than the critical remediation window”: a critical finding can breach its window before it is due to be triaged.

Published standards

Five standards are available to adopt as they are.

Standard	Critical	High	Medium	Low	Grace (C/H/M/L)	Triage	Exposure	Threat
Baseline CVSS	30	90	180	365	30 / 90 / 180 / 365	30	2	14
NIST SP 800-40	30	30	90	120	30 / 30 / 90 / 180	1	2	14
FedRAMP	30	30	90	180	30 / 30 / 90 / 180	14	30	14
Essential 8	2	14	14	14	2 / 14 / 60 / 90	1	2	14
CISA BOD 19-02	15	15	30	30	15 / 15 / 30 / 30	1	15	15

All days. Every standard uses severity bands high 8.9, medium 6.9, low 4.0.

Saving a custom policy

A custom save never edits a policy in place. It writes a new policy row and points your organisation at it. The previous row stays, because past scans record which policy was in force and past compliance reports cited it; editing it would restate history. The published standards are never written.

One policy is in force per organisation. A save or an adopt replaces the link.

API

Method	Path	Body	Returns
GET	/v1/triage-policy		{policy, linked, presets, warnings}. policy is null and linked is false when none is set. presets is the published standards.
PUT	/v1/triage-policy	{adoptUuid} to adopt a standard or one of your earlier policies, or the fields above to save a custom one	{policy, linked: true, warnings}

Status	Cause
400	invalid body, or invalid policy with errors
401	not signed in
404 policy not found	adoptUuid is not a published standard or a policy of yours
409	your organisation has no scan data yet. Run a scan first.

API=https://www.vulnetix.com/api/site/v1
AUTH="Authorization: ApiKey $VULNETIX_ORG_ID:$VULNETIX_API_KEY"

# Adopt NIST SP 800-40
NIST=$(curl -sS "$API/triage-policy" -H "$AUTH" | jq -r '.presets[] | select(.name=="NIST SP 800-40") | .uuid')
curl -sS -X PUT "$API/triage-policy" -H "$AUTH" -H 'Content-Type: application/json' -d "{\"adoptUuid\":\"$NIST\"}"

# Or save your own
curl -sS -X PUT "$API/triage-policy" -H "$AUTH" -H 'Content-Type: application/json' -d '{
  "name":"Acme SLA",
  "criticalRemediationDays":7,"highRemediationDays":30,"mediumRemediationDays":90,"lowRemediationDays":180,
  "criticalThresholdAllowance":0,"highThresholdAllowance":7,"mediumThresholdAllowance":14,"lowThresholdAllowance":30,
  "triageThresholdDays":3,"exposureWindowDays":7,"threatWindowDays":14,
  "severityHighThreshold":7.0,"severityMediumThreshold":4.0,"severityLowThreshold":0.1}'

Related

• Risk strategies decide order; this policy decides deadlines.
• Compliance for the reports that cite it.