RA-5 / SI-2 NIST SP 800-53 Rev 5

Are findings prioritised with business context (data classification, regulatory scope, criticality)?

Demonstrate that security findings are consistently prioritized using documented business context including data classification, regulatory scope, and asset criticality to ensure risk-based remediation sequencing.

Description

What this control does

This control ensures that security findings from vulnerability scans, penetration tests, and security assessments are ranked using organizational context such as asset criticality ratings, data classification levels (e.g., PII, PCI, PHI), regulatory applicability (e.g., GDPR, HIPAA, SOX), and business impact tolerance. Findings affecting critical systems storing sensitive data or subject to compliance mandates receive elevated priority over identical vulnerabilities in non-production or non-regulated environments. This contextual prioritization enables security teams to allocate remediation resources efficiently and meet regulatory deadlines while managing large vulnerability backlogs.

Control objective

What auditing this proves

Associated risks

Risks this control addresses

Critical vulnerabilities in systems processing regulated data remain unremediated while resources address lower-risk findings in non-critical environments
Regulatory compliance violations and penalties occur when findings affecting in-scope systems miss mandated remediation deadlines
Breach of high-value data assets because vulnerabilities in systems handling sensitive information are treated with same priority as development environments
Inefficient resource allocation where remediation efforts focus on high CVSS scores without considering actual business impact or exploitability in context
Executive leadership makes uninformed risk acceptance decisions lacking visibility into which findings affect mission-critical or regulated operations
Audit findings or regulatory sanctions result from inability to demonstrate risk-based prioritization methodology during compliance examinations
Attackers exploit known vulnerabilities in internet-facing systems containing customer PII while teams remediate isolated internal findings first

Testing procedure

How an auditor verifies this control

Obtain the organization's documented finding prioritization policy or procedure including definitions of data classification levels, asset criticality ratings, and regulatory scope categories
Request the current vulnerability management or security finding repository (e.g., SIEM, GRC platform, ticketing system) and export a sample of 25-30 findings from the past quarter covering various severity levels
For each sampled finding, verify that documented business context attributes are recorded including asset criticality classification, data classification of affected systems, and applicable regulatory frameworks
Select five high-severity findings and trace their prioritization decisions back to supporting evidence such as asset inventory records showing criticality ratings, data flow diagrams indicating classification, and compliance scope documentation
Interview security operations personnel to confirm how they apply business context when triaging new findings and request walkthrough of prioritization decisions for three recent critical vulnerabilities
Review remediation SLA policies and validate that target timelines differ based on business context (e.g., 7 days for critical findings in PCI scope vs. 30 days for medium findings in non-production)
Examine a sample of risk acceptance decisions or remediation deferrals to verify business context justification is documented and approved by appropriate stakeholders
Compare the prioritization methodology against regulatory requirements applicable to the organization (e.g., PCI DSS vulnerability management timelines, HIPAA risk analysis requirements) to confirm alignment

Evidence required Collect the vulnerability prioritization policy document, configuration exports or screenshots from the vulnerability management platform showing business context fields populated for sample findings, asset inventory extracts with criticality and classification metadata, data flow diagrams or data classification matrices, regulatory scope documentation (e.g., systems-in-scope lists for PCI, HIPAA, GDPR), sample remediation tickets showing differentiated SLAs based on context, risk acceptance forms with business justification, and interview notes or meeting minutes demonstrating operational application of the prioritization framework.

Pass criteria All sampled findings include documented business context attributes (data classification, regulatory scope, asset criticality), prioritization decisions demonstrably incorporate these contextual factors with differentiated remediation timelines, and the methodology aligns with applicable regulatory vulnerability management requirements.