title = "Vulnerability Management"

content = """
Vulnerability management is the continuous process of identifying, classifying,
remediating, and verifying security weaknesses in systems within the unit's AOR.
It is governed by DoD Information Assurance Vulnerability Management (IAVM) directives
and supplemented by Security Technical Implementation Guides (STIGs).

**Scanning Schedule:** Authenticated vulnerability scans run weekly against all
internet-accessible systems and monthly against internal hosts. Scans use credentialed
access to enumerate missing patches, misconfigured settings, and software with known
vulnerabilities. Scan results are automatically ingested into the vulnerability
management platform for tracking.

**IAVM Compliance:** When DoD releases an IAVM notice (Alert, Bulletin, or Technical
Advisory), the unit must acknowledge receipt within one business day and remediate within
the specified window — typically 21 days for Alerts, 30 days for Bulletins. Systems
unable to meet the deadline require a documented Plan of Action and Milestones (POA&M)
with a waiver approved by the ISSO and authorizing official.

**STIG Hardening:** New systems are hardened against applicable STIGs before connection
to any enclave. STIG checklists are completed by the system administrator and reviewed
by the ISSO. Automated tools (such as SCAP-compliant scanners) verify STIG compliance
as part of the ATO package and ongoing continuous monitoring.

**Risk Scoring and Prioritization:** Findings are scored using CVSS. Critical and High
findings receive remediation priority over Medium and Low findings. Business context
modifies priority — a High finding on a mission-critical system outranks a Critical
finding on a test system. Owners are assigned to each open finding with a target date.

**Verification:** After remediation, the system is rescanned to confirm closure. A
finding is only marked "closed" in the tracking system once a clean scan result is
documented. Unverified remediations remain open until evidence is provided.
"""

version = "0.0.1"
