VULNERABILITY MANAGEMENT
A vulnerability program with a ranking model you can argue with.
Finding vulnerabilities is not the hard part; defending the order of work is. We scan on an agreed cycle, triage before ticketing, state the ranking and name one owner per finding.
Two artifacts, named the same way across this site.
- Cycle ReportAt each cycle's close: what changed, exceptions with review dates, open findings aged by rank.
- Leadership ReportOn the agreed calendar: trend, measured coverage, exceptions due, and data limits such as missing assets, so a number is never presented without what it does not count.
The cycle, step by step.
- Scanning against an agreed asset list. New assets arrive by a stated route: you tell us, or the next pass finds one and we ask whose.
- Triage before ticketing: duplicates, findings that do not apply and findings the scan cannot confirm are settled first, so the queue is not raw scan output with a due date.
- Ranking on the model below, reasons recorded.
- A named owner per finding worked: a person, not a team. Unowned findings become exceptions with review dates.
- Verification, one round each cycle. A finding not verified as fixed is still open, and the register says so.
- The Cycle Report closes the cycle.
Each finding is marked as uncredentialed, seen from the network, or credentialed, confirmed inside the host.
The ranking model, stated so you can disagree with it.
The report states the model and its sources, so a rank can be defended to a director, an examiner or a counterparty, or disputed.
| Input | What it reads | Yours to change |
|---|---|---|
| Technical severity | The weakness itself | No |
| Known exploitation | Use in the wild, the CISA catalog included | No |
| Exposure | How exposed the asset is | Yes |
| Asset importance | What the asset means to your business | Yes |
Where the inputs disagree, exposure and asset importance decide: the same weakness on an internet facing host and a laboratory machine is not the same finding.
A rank nobody can argue with is a rank nobody owns.
CISA Known Exploited Vulnerabilities Catalog, BOD 26-04
Its remediation timelines are set under Binding Operational Directive 26-04, which superseded BOD 22-01 in June 2026.
Federal civilian executive branch agencies. This program ranks findings taking the CISA Known Exploited Vulnerabilities Catalog as one input and not as a deadline, since the remediation timelines attached to it bind federal civilian agencies and not you.
What continues, what ends, and what you keep.
An assessment ends. Each COST cycle ends; the next starts on the agreed cadence. Vulnerabilities do not end: new ones are published every week, so this is continuing work, not a project quietly repeated.
Term, renewal trigger, notice and calendar are in writing before you sign. If it ends, you keep the asset list, findings register, exception record and every report.
What it needs from you.
An asset list you already believe is imperfect, a route for new assets, credentials, and one person per area who can accept or refuse a finding.
Access, and getting it back
- We state in writing the access we need and why, at the lowest level that will answer the question.
- You grant it, decide what it is scoped to, and can revoke it at any moment without asking us.
- At closure we list in writing what to remove, item by item, and ask you to confirm it is removed.
The commitment in full is on Trust and Assurance.
When a rule or a contract sets the cadence.
Where the Safeguards Rule reaches you, 16 CFR 314.4(d)(2) sets the cadence: absent continuous monitoring, vulnerability assessments at least every six months, annual penetration testing, and testing on a material change.
| Instrument | Why it matters here | Who it reaches, and who it does not |
|---|---|---|
| FTC Safeguards Rule, 16 CFR Part 314 | It sets a nonbank lender's scanning cadence. | Reaches Nonbank financial institutions under FTC jurisdiction. Not Banks, savings associations, federally insured credit unions. Exempt Below 5,000 consumers whose information you maintain (not employees, loans or dollars), 314.6 lifts the written risk assessment (an unwritten one is still owed), testing cadence, written incident response plan and board report. The rest, 314.4(f) and FTC notice included, applies at any size. |
| Freddie Mac Single-Family Seller/Servicer Guide, Chapter 1302 | A mortgage company exempt from the Safeguards Rule cadence may still owe this one. | Clock 48 hours to Freddie Mac from discovering a security incident, third party incidents included. Testing Annual penetration test by a qualified and independent third party, not an internal team; 314.6 does not remove it. Reaches Single-Family Sellers and Servicers, by contract, with no size exemption; Multifamily is separate. Not Anyone outside the relationship. |
| NYDFS Cybersecurity Regulation, 23 NYCRR Part 500 | Its exemption decides whether testing is yours. | Reaches Holders of a DFS license, registration, charter or similar authorization. Not A firm whose only link is a New York customer. Exempt Any one of three 500.19(a) tests, set out on Mortgage, removes penetration testing and vulnerability assessment (500.5); never the 72 hour or 24 hour notices in 500.17. |
This firm builds the program and the evidence to the shape the instrument requires. Counsel confirms the legal reading for your state.
What the program is not.
No security operations center, help desk, endpoint service, overnight alerts or user support. Depth against a named target: Offensive Security. An estate never looked at whole: the Security Assessment first.
An AI feature changes the estate unannounced. We ask what is exposed; the AI Vendor and Third Party Review asks who approved it and what it may decide. The vendor is a third party either way.
| Question | Answer |
|---|---|
| Proof of compliance | No. It gives an examiner or counterparty dated evidence to reach their own conclusion. No report from this firm is represented as proof that an environment is secure or compliant. |
| Something urgent | We stop and tell you the same working day, by the escalation path and to the named person agreed in writing before the work began. |
| Retest | One round of verification of remediated findings is included in the fee as standard. Further rounds are quoted, and the proposal states the window. |
| Do we have to use a particular scanner? | No. What you run is what gets used; advice is not tied to product sales. |
Approved once, then it runs.
Tell us what you scan and who owns the order of work.
- Unit
- A recurring cycle with a periodic Leadership Report
- Fee
- For each cycle, in writing once the written shape of the work is agreed, before you sign.
- Term and hours
- The term and your team's hours, in writing, with the fee.
- A changed scope
- Requoted, showing which change moved the number.
- A number that proves wrong
- You hear the day we know.
The commitment in full is on Trust and Assurance.