Cybersecurity Policy Generator

# Acme Corporation — Enterprise Vulnerability & Patch Management Policy
**Effective Date:** September 20, 2026  
**Classification:** Internal — Mandatory Compliance  
**Standard Alignment:** CISA BOD 22-01 / SOC 2 Type II / ISO 27001 A.12.6.1

---

## 1. Purpose & Scope
This policy defines the technical standards, remediation timelines, and governance requirements for identifying, assessing, and remediating security vulnerabilities across all software, cloud infrastructure, firmware, and endpoints owned or operated by Acme Corporation.

## 2. Remediation Timelines & Service Level Agreements (SLAs)
All vulnerabilities identified via automated scanning or third-party disclosures must be patched or mitigated according to the following strict SLA matrix:

- **CISA Known Exploited Vulnerabilities (KEV):** Must be patched within **14 calendar days** of catalog addition, or immediately isolated from public ingress.
- **Critical Severity (CVSS 9.0 – 10.0):** Must be patched or shielded with compensatory edge controls within **14 calendar days**.
- **High Severity (CVSS 7.0 – 8.9):** Must be patched within **30 calendar days**.
- **Medium Severity (CVSS 4.0 – 6.9):** Must be remediated during the next scheduled quarterly release cycle (not to exceed 90 days).
- **Low Severity (CVSS 0.1 – 3.9):** Addressed as part of ongoing maintenance.

## 3. Continuous Vulnerability Scanning
Acme Corporation mandates continuous, automated vulnerability scanning across all external perimeter IPs, container registries, and internal subnets. Unauthenticated and uncredentialed scans must run weekly; credentialed host scans must execute at least monthly.

## 4. Emergency Out-of-Band Patching
In the event of an actively exploited zero-day vulnerability without an official vendor patch:
1. Security Operations must immediately enforce compensatory edge WAF rules or network segmentation boundaries.
2. If network shielding is insufficient, the affected asset must be quarantined until patch verification is complete.

## 5. Compliance & Auditing
Failure to comply with patch timelines creates severe regulatory liabilities. Compliance audits will be reviewed quarterly by the Chief Information Security Officer (CISO).