SI-2.3: Time to Remediate Flaws and Benchmarks for Corrective Actions

the time between flaw identification and flaw remediation is measured;

benchmarks for taking corrective actions have been established.

System and information integrity policy

system and information integrity procedures

procedures addressing flaw remediation

system design documentation

system configuration settings and associated documentation

list of benchmarks for taking corrective action on identified flaws

records that provide timestamps of flaw identification and subsequent flaw remediation activities

system security plan

other relevant documents or records

System/network administrators

organizational personnel with information security responsibilities

organizational personnel installing, configuring, and/or maintaining the system

organizational personnel responsible for flaw remediation

Organizational processes for identifying, reporting, and correcting system flaws

mechanisms used to measure the time between flaw identification and flaw remediation