Cybersecurity GRC 15 items
Vulnerability Management Program Audit
Audits the maturity of a vulnerability management program covering discovery, prioritization, remediation, and metrics.
NIST 800-53ISO 27001:2022PCI DSS 4.0
Free PDF · enter your email to download.
Program & Asset Coverage
- Is a documented vulnerability management policy defined with roles and SLAs? *
- Is an authoritative asset inventory used to ensure full scan coverage? *
- Are cloud, container, and endpoint assets included in scope? *
Discovery & Scanning
- Are authenticated vulnerability scans performed on a defined schedule? *
- Are external-facing systems scanned at least quarterly? *
- How frequently are internal vulnerability scans performed (days)?
- Is scan tooling kept current with the latest vulnerability signatures? *
Prioritization & Risk Scoring
- Are vulnerabilities prioritized using CVSS and exploitability context (e.g., CISA KEV, EPSS)? *
- Are remediation SLAs defined by severity level? *
- Are risk acceptances for unpatched items documented and approved? *
Remediation & Verification
- Are patches deployed within the defined SLA for critical vulnerabilities? *
- Is remediation verified by rescanning after patching? *
- What percentage of critical vulnerabilities are remediated within SLA?
Reporting & Metrics
- Are vulnerability metrics and trends reported to management? *
- Is mean time to remediate (MTTR) tracked over time? *
Download the full Vulnerability Management Program Audit checklist
Get it as a clean, printable PDF — free.