目标和sla
Between the notifications of high criticality vulns 和 back-和-forth email communications that frequently come with vulnerability assessment, we don't often get to ask ourselves, "what is the true effectiveness of my vulnerability management program?" This question becomes increasingly difficult to answer when the completion of remediation tasks spans multiple teams 和 projects. This is where 目标和sla come in.
目标和sla, you can ensure that you're making (和 tracking) progress toward your goals 和 service level agreements (SLAs) at an appropriate pace, 和 maintaining compliance with the st和ards you've set for your program.
有时限的目标
Time bound goals were designed to help you track risk reduction from a static asset or vulnerability by a pre-determined date. Let's use zero-day threats as an example: Since it's imperative that you react quickly to these disclosures, time bound goals can ensure that you 和 your team address all assets impacted by the specified vulnerability within a two week window.Service Level Agreement (SLA) Goals
SLA goals track your ability to meet certain policies over a dynamic time span. These goals may resemble conditions like, "remediate 100% of critical vulnerabilities in production environments within three days of discovery," or "remediate 75% of Windows servers within 15 days of asset discovery date." Because SLA goals are dynamic in scope, newly discovered assets or vulnerabilities that meet this criteria are automatically included in tracking.连续的目标
Continuous goals monitor your progress or adherence with ongoing criteria, such as a rule or key performance indicator, 没有严格的时间限制. Need all of your external-facing assets to have a closed SSH port, for instance? 连续的目标 can track your adherence to this policy by also leveraging dynamic scope.