1. Preserve and scope
Record the advisory, original export, discovery time, affected versions, and an inventory-reconciled asset denominator before changing the environment.
24 controls · 13 fields · public CSV · no signup
Move a CVE from a scanner finding to verified closure.
Use this evidence register when security identifies a vulnerability and IT must remediate it across an endpoint fleet. It keeps the asset denominator, risk decision, deployment evidence, failures, exceptions, independent rescan, and residual risk in one owned record.
Download the CSVTriage patch failuresGovern an exceptionReconcile the denominatorUse the patch-management guide
2. Prioritize risk
Combine exploitation evidence, reachability, asset criticality, compensating controls, business impact, and deployment risk instead of ranking by severity alone.
3. Assign the handoff
Name security and IT owners, a decision authority, the requested action, due date, dependencies, and exact acceptance evidence.
4. Pilot and expand
Test a representative canary, define stop and rollback rules, then expand through controlled rings with per-device outcomes.
5. Own every failure
Keep offline, stale, failed, reboot-pending, excepted, and unknown endpoints visible with an owner and deadline until their state is resolved.
6. Validate independently
Run a fresh vulnerability or version assessment, reconcile the post-action denominator, and require both owners to accept residual risk before closure.
Primary-source notes
- CISA's vulnerability-response playbook directs organizations to use rapid-response processes for actively exploited vulnerabilities, apply mitigations when patches cannot be used immediately, and track remediation status.
- Microsoft's Defender Vulnerability Management workflow separates the remediation request from execution, records priority and due date, creates a trackable activity, and supports progress and completion evidence.
- Microsoft's security-recommendation guidance exposes affected devices, remediation and exception options, and notes that endpoint changes may take time to appear in the security portal.