Define remediation SLAs and exception workflow for findings
Implementation Effort: Medium – Setting remediation timelines by severity and building a documented exception workflow requires agreement across security, engineering, and leadership. User Impact: Low – Defining SLAs and the exception process is a governance and administrator activity; end users are not affected. Lifecycle Stage: Govern
Overview
Define remediation SLAs for security findings by severity, and require a documented exception workflow when teams cannot remediate within the required timeline.
Security scanning tools across the DevSecOps pipeline — CodeQL, secret scanning, GitHub Dependabot or GitHub Advanced Security for Azure DevOps dependency scanning, infrastructure-as-code scanning, and container image scanning — generate a continuous stream of findings. Without clearly defined remediation timelines, those findings accumulate into a backlog that teams deprioritize against feature work, leaving critical issues unresolved for weeks or months.
The absence of a formal exception process creates a second problem. When a finding can't be remediated immediately because of a legitimate business constraint, teams either ignore it or suppress it without documentation, which destroys audit trails and hides accepted risk from leadership.
Establishing remediation SLAs tied to finding severity creates a shared, enforceable contract between security and engineering teams. A typical model sets aggressive timelines for critical and high-severity findings — measured in days, not sprints — with progressively longer windows for medium and low findings.
When a team cannot meet the SLA, a documented exception workflow should require the finding owner to record the business justification, identify compensating controls, set a review date, and obtain approval from a defined risk authority. This exception record becomes part of the organization's risk register, visible to security leadership and auditors alike.
Organizations that operate without remediation SLAs cannot claim a strong security posture from scan coverage alone. What matters is how quickly findings are resolved and how transparently risk is managed when they are not. Enforcing remediation SLAs and documenting exceptions supports Assume breach by ensuring known weaknesses are closed quickly or formally risk-accepted, limiting the window in which threat actors could exploit them.