Skip to main content
← All controls
IR-4 / IR-5 / A.16.1.4 / CIS-17.2 NIST SP 800-53 Rev 5

Is there a documented incident process for attack-surface findings (with severity SLAs)?

Demonstrate that the organization maintains a documented incident response process specifically for attack surface findings, with measurable severity-based SLAs that govern response and remediation timelines.

Description

What this control does

This control requires a formal, documented incident response process specifically tailored to security findings identified through attack surface management activities (external asset discovery, exposed service enumeration, vulnerability scanning of internet-facing assets). The process must include defined severity classifications and corresponding service-level agreements (SLAs) that dictate maximum response and remediation timeframes based on risk levels. This ensures that externally visible vulnerabilities—often the easiest path for attackers—are triaged and remediated systematically rather than ad hoc, reducing the window of exploitability.

Control objective

What auditing this proves

Demonstrate that the organization maintains a documented incident response process specifically for attack surface findings, with measurable severity-based SLAs that govern response and remediation timelines.

Associated risks

Risks this control addresses

  • Critical vulnerabilities on internet-facing assets remain unpatched beyond acceptable risk windows, enabling exploitation by opportunistic or targeted threat actors
  • Inconsistent or delayed response to external exposure findings allows attackers to leverage reconnaissance data before defensive action is taken
  • Lack of severity-based prioritization leads to misallocation of security resources, addressing low-risk findings while critical exposures persist
  • Absence of documented SLAs prevents accountability and measurement, obscuring chronic response failures and organizational risk posture degradation
  • Attack surface findings fall outside standard incident response workflows and are lost or ignored, creating blind spots in vulnerability management
  • Regulatory or contractual breach due to failure to remediate known external vulnerabilities within mandated timeframes
  • Reputational damage and loss of customer trust when publicly accessible security weaknesses are exploited after being identified but not remediated

Testing procedure

How an auditor verifies this control

  1. Request and review the documented incident response process or runbook specifically addressing attack surface management findings.
  2. Identify and document the severity classification scheme used for external findings (e.g., Critical, High, Medium, Low) and verify alignment with organizational risk appetite.
  3. Extract and record the defined SLAs for each severity level, including maximum time-to-acknowledge, time-to-triage, and time-to-remediate or accept.
  4. Select a sample of 10-15 attack surface findings from the past 12 months spanning all severity categories from the asset inventory or vulnerability management system.
  5. For each sampled finding, trace the timeline from discovery through acknowledgment, triage, and closure, recording actual elapsed times at each stage.
  6. Compare actual response times against documented SLAs to identify instances of non-compliance or SLA breaches.
  7. Interview incident response and security operations personnel to confirm awareness of the process, understanding of SLAs, and adherence in practice.
  8. Review escalation procedures for SLA breaches or high-severity findings and validate evidence of escalation in at least two historical cases.
Evidence required Collect the documented incident response policy or procedure specific to attack surface findings, including severity definitions and SLA tables. Obtain spreadsheets, ticketing system exports, or SIEM logs showing discovery timestamps, triage dates, and remediation completion dates for sampled findings. Capture screenshots of ticketing workflows, escalation records, and management reports demonstrating SLA tracking and compliance measurement.
Pass criteria A documented process exists that explicitly addresses attack surface findings with defined severity levels and corresponding SLAs, and at least 80% of sampled findings in the past 12 months met their applicable SLAs with documented evidence of escalation for breaches.