{"id":162714,"date":"2026-08-14T10:23:47","date_gmt":"2026-08-14T14:23:47","guid":{"rendered":"https:\/\/www.bu.edu\/tech\/?page_id=162714"},"modified":"2026-08-14T10:35:48","modified_gmt":"2026-08-14T14:35:48","slug":"vulnerability-management-procedure","status":"publish","type":"page","link":"https:\/\/www.bu.edu\/tech\/about\/policies\/vulnerability-management-procedure\/","title":{"rendered":"Vulnerability Management Procedure"},"content":{"rendered":"

Effective: May 12, 2026<\/p>\n

<\/a>Purpose and Scope<\/h2>\n

This procedure extends the Vulnerability Management Standard in the Data Protection Standards.<\/p>\n

<\/a><\/a>Program Management<\/h2>\n

Vulnerability\u00a0Management is a\u00a0Service Component\u00a0of\u00a0the\u00a0Server Security\u00a0Services\u00a0Client Service.\u00a0 The Director\u00a0of Information Security is the Service\u00a0Owner\u00a0and\u00a0is\u00a0responsible for service delivery. The Director\u00a0shall\u00a0appoint a Service Component Manager and a Vulnerability Manager as defined in this document. A combination of these roles may be held by the same person.<\/p>\n

<\/a><\/a>Procedures<\/h2>\n

The Chief Information Security Officer shall charter a Vulnerability Advisory Board (VAB) to implement the Vulnerability Management Program.\u00a0 The VAB will be led by the Vulnerability Manager.<\/p>\n

The VAB will meet regularly to review and evaluate patch and vulnerability scan data, assign priorities to vulnerabilities, and determine what remediation projects will be assigned and executed for the upcoming days\/month(s).<\/p>\n

Emergency VAB meetings will take place on an as needed basis to deal with urgent threats.<\/p>\n

The VAB creates and assigns remediation projects, reports on progress in remediating vulnerabilities, escalates issues and risks relating to non-remediated vulnerabilities, and authorizes Systems Administration to assign patch and reboot schedules on behalf of unresponsive system owners.<\/p>\n

<\/a>Remediation Target Priorities<\/h3>\n

The following table defines how remediation priorities will be assigned and the target resolution timeframe for vulnerabilities in each priority\u00a0rank.\u00a0 The use of \u201cdays\u201d versus \u201cbusiness days\u201d in expressing times is significant \u2013 not all vulnerabilities can wait until the start of the next business day.<\/p>\n\n\n\n\n\n\n\n\n
Priority Rank<\/u><\/td>\nDefinition<\/u><\/td>\nInitial Assignment<\/u><\/td>\nTarget Resolution<\/u><\/td>\n<\/tr>\n
P1<\/td>\nVulnerability that is remotely exploitable with no compensating controls<\/td>\n1 day<\/td>\n2 days<\/td>\n<\/tr>\n
P2<\/td>\nVulnerability that is remotely exploitable with compensating controls<\/td>\n2 business days<\/td>\n1 week<\/td>\n<\/tr>\n
P3<\/td>\nVulnerability that is not remotely exploitable<\/td>\nroutine patching<\/td>\n45-60 days<\/td>\n<\/tr>\n
P4<\/td>\nVulnerability that cannot immediately be exploited.<\/td>\nroutine patching<\/td>\n60 days<\/td>\n<\/tr>\n
<\/td>\n<\/td>\n<\/td>\n<\/td>\n<\/td>\n<\/td>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

 <\/p>\n

It may be necessary to further prioritize hosts within\u00a0the\u00a0priority\u00a0rankings above. \u00a0Hosts should be prioritized according to Data Classification with hosts containing Restricted Use data remediated first. \u00a0Note that some compliance\u00a0requirements like PCI\u00a0might dictate shorter resolution time frames.\u00a0Once Restricted Use systems are secured the remainder should be remediated according to risk, considering the impact of a breach and the likelihood of compromise. \u00a0The use of private network\u00a0addressing,\u00a0and other compensating controls\u00a0may\u00a0be used to prioritize the list. \u00a0 The VAB may provide additional guidance on a case-by-case basis.<\/p>\n

Exceptions<\/h3>\n

Devices not in compliance with the Vulnerability Management Standard or this procedure must complete the risk acceptance process or be disconnected from the network.<\/p>\n

As general rules:<\/p>\n