Report on the average time elapsed between vulnerability or weakness discovery and implementation of corrective action.

UCF ID: 02140

Control Type: Actionable Reports or measurements

Status: Live

Metric guidance

Calculation: The calculation for this metric is The date of vulnerability or weakness discovery + the date the vulnerability or weaknesses was corrected.

Calculation source: The authority document source of information is NIST 800-55, Critical Element 2.2. The following formula was used: the sum of the number of weaknesses closed in 30 days, 60 days, 90 days, 180 days, and 1 year divided by the total number of weaknesses closed in the last year for each business unit (or the organization as a whole) .

The Common Control IDs associated with this metric are as follows:

Prioritize and select safeguards based on the risk assessment findings. [UCF Control ID 00707]

Establish and maintain a risk action plan based on the risk assessment findings. [UCF Control ID 00705]

Supporting and supported controls

This control directly supports:

Establish and maintain an incident management and vulnerability detection and response management metrics program. [UCF Control ID 02085]

There are no supporting controls.

Authority documents complied with:

Performance Measurement Guide for Information Security, NIST 800-55, Revision 1, App A Measure 16

NIST Guidance

The calculation for this metric should be stated as the # of vulnerabilities corrected / # of vulnerabilities identified during vulnerability scans. Use the total number of vulnerabilities discovered during the vulnerability scans for each business unit (or the organization as a whole) as the base number divided by the number of vulnerabilities that were corrected within the specified time period. [App A Measure 16, Performance Measurement Guide for Information Security, NIST 800-55, Revision 1]