Vulnerability Management Skill

Purpose

Provide systematic procedures for proactive vulnerability discovery, intelligent remediation, and transparent security communication across all Hack23 projects, with measurable SLAs aligned with business impact.

Rules

Severity Classification and SLAs

Severity	CVSS Score	SLA	Escalation
Critical	9.0-10.0	7 days	CEO immediate
High	7.0-8.9	30 days	CEO within 1 day
Medium	4.0-6.9	90 days	Weekly review
Low	0.1-3.9	180 days	Monthly review

Detection Sources

MUST enable on all repositories:

• GitHub Dependabot for automated dependency vulnerability alerts
• GitHub CodeQL for code-level vulnerability scanning
• GitHub Secret Scanning for credential exposure
• OWASP Dependency Check (where applicable)

Vulnerability Lifecycle

Phase 1: Discovery

• MUST enable automated scanning on all repositories
• MUST process vulnerability alerts within 24 hours of detection

Phase 2: Assessment

• MUST evaluate CVSS score, exploitability, attack surface, and data exposure
• MUST consider contextual risk (is the vulnerable component reachable?)
• MUST document risk assessment for each vulnerability

Phase 3: Remediation

• MUST prioritize patches and version upgrades as primary remediation
• MUST create security-prefixed branches for fixes: security/CVE-YYYY-XXXXX
• MUST include CVE reference and CVSS score in commit messages
• MUST validate fix with security scanners before merging

Phase 4: Verification

• MUST confirm vulnerability resolved by security scanner
• MUST ensure no new vulnerabilities introduced
• MUST pass all existing tests

Phase 5: Closure

• MUST document resolution in changelog
• MUST close associated GitHub Security Advisory
• MUST conduct lessons-learned for Critical/High severity

Risk Acceptance

Risk acceptance MUST:

• Be approved by CEO
• Be valid for maximum 90 days
• Include documented compensating controls
• Be tracked in the risk register
• Be reviewed monthly

Hack23 ISMS Policy References

• Vulnerability Management
• Secure Development Policy
• Incident Response Plan

Compliance Mapping

• ISO 27001:2022: A.8.8 (Technical Vulnerability Management)
• NIST CSF 2.0: DE.CM-8 (Vulnerability Scans), ID.RA (Risk Assessment)
• CIS Controls v8.1: Control 7 (Continuous Vulnerability Management)
• OWASP Top 10: A06:2021 (Vulnerable and Outdated Components)