| ID | Asset | CVSS | EPSS | KEV | Asset criticality | Exposure | Priority | SLA |
|---|---|---|---|---|---|---|---|---|
| VULN-881 | VPN appliance | 9.8 | 0.94 | Yes | High | Internet | 92 | 72 h |
| VULN-879 | client-portal XML parser | 8.1 | 0.31 | No | High | Internet | 54 | 14 days |
| VULN-870 | SRV-GOAML-2 kernel | 7.8 | 0.07 | No | High | Internal | 28 | 30 days |
| VULN-866 | Old CMS plugin | 6.1 | 0.62 | Yes | Low | Internet | 44 | 14 days |
| Exception | Finding | Compensating controls | Expires | Approver | Status |
|---|---|---|---|---|---|
| RA-71 | VULN-870 | Host isolated in the data tier, no inbound routes | 30 days | CISO | Approved |
P = 100 × (CVSS / 10) × (0.4 + 0.6 × EPSS) × KEV × A × X KEV = 1.5 if listed in CISA KEV else 1.0 A = asset criticality: 1.0 high · 0.7 medium · 0.4 low X = exposure: 1.0 internet · 0.6 internal · 0.3 isolated SLA = 72 h if P ≥ 70 · 14 days if P ≥ 40 · else 30 days