Initial commit - 611 cybersecurity skills across all subdomains

skills/implementing-vulnerability-remediation-sla/references/standards.md

@@ -0,0 +1,24 @@
+# Standards and References - Vulnerability Remediation SLA
+
+## Regulatory SLA Requirements
+- **PCI DSS v4.0 Req 6.3.3**: Address vulnerabilities by risk ranking (critical/high within 30 days)
+- **CISA BOD 22-01**: Federal agencies must remediate KEV within specified timeframes
+- **NIST SP 800-40 Rev 4**: Enterprise Patch Management Planning
+- **SOX**: Timely remediation of IT control deficiencies
+- **HIPAA**: Reasonable and appropriate security measures including patching
+
+## Industry Benchmarks
+| Severity | CISA BOD 22-01 | PCI DSS | CIS Benchmark | Best Practice |
+|----------|---------------|---------|---------------|---------------|
+| Critical | 14 days (KEV) | 30 days | 48 hours | 24-48 hours |
+| High | N/A | 30 days | 7 days | 7-14 days |
+| Medium | N/A | 90 days | 30 days | 30 days |
+| Low | N/A | Next cycle | 90 days | 90 days |
+
+## KPI Benchmarks (Industry Average)
+| Metric | Average | Top Quartile | Best in Class |
+|--------|---------|--------------|---------------|
+| SLA Compliance | 65% | 85% | >95% |
+| MTTR (Critical) | 15 days | 5 days | <2 days |
+| MTTR (High) | 30 days | 14 days | <7 days |
+| Vuln Backlog | 25% | 10% | <5% |

skills/implementing-vulnerability-remediation-sla/references/workflows.md

@@ -0,0 +1,51 @@
+# Workflows - Vulnerability Remediation SLA
+
+## Workflow 1: SLA Assignment and Tracking
+
+```
+Vulnerability Discovered
+    │
+    ├──> Determine Severity (CVSS + EPSS + KEV)
+    ├──> Determine Asset Tier (CMDB lookup)
+    ├──> Calculate SLA Deadline
+    │
+    ├──> Create Remediation Ticket (Auto)
+    │       ├──> Assign to responsible team
+    │       ├──> Set SLA deadline
+    │       └──> Include remediation instructions
+    │
+    ├──> Monitor Progress
+    │       ├──> 50% elapsed: Status check
+    │       ├──> 75% elapsed: Warning notification
+    │       └──> 100% elapsed: Breach escalation
+    │
+    └──> Verify Remediation
+            ├──> Re-scan target
+            ├──> Confirm vulnerability resolved
+            └──> Close ticket
+```
+
+## Workflow 2: SLA Breach Escalation
+
+```
+SLA Breached (100% elapsed)
+    │
+    ├──> Day 0: Auto-notify asset owner + manager
+    ├──> Day 7: Escalate to department head
+    ├──> Day 14: Escalate to CISO
+    ├──> Day 30: Require formal risk acceptance
+    └──> Day 90: Report to executive committee
+```
+
+## Workflow 3: Exception Management
+
+```
+Exception Request Submitted
+    │
+    ├──> Validate justification
+    ├──> Verify compensating controls
+    ├──> Risk assessment review
+    │
+    ├──> Approved → Set new deadline, document in system
+    └──> Denied → Original SLA enforced, escalate
+```