Vulnerability Management Policy

Purpose

Find vulnerabilities in our code, dependencies, images and infrastructure, assess their risk, and fix them within set timelines.

Scope

All systems in scope of these policies: source code repositories, application dependencies, container and machine images, cloud infrastructure and configuration, and secrets.

Roles and responsibilities

How we find vulnerabilities

These controls are configured outside this site, mostly as code, so each one can be checked where it's defined.

Advisory AI reviews (Sentry Seer, GitHub Copilot) may also flag issues, and those are triaged like any other report.

Requirements

VM-1. Scanning stays enabled. The sources above stay enabled for all in-scope repositories and accounts. Turning one off, or excluding a repository or account, needs an exception.

VM-2. Rate each finding's severity. Use the scanner's or advisory's rating (CVSS where available) as the starting point, then adjust for real exposure: whether the vulnerable code is reachable, whether the system is internet-facing, what data it holds, and whether there's a known exploit. Record the final severity and the reason for any change on the finding.

VM-3. Triage promptly. New findings are triaged, meaning a severity is set and an owner is assigned. Findings that look Critical are triaged within one business day, so the seven-day fix deadline in VM-4 stays achievable. All other findings are triaged within five business days. Platform Engineering triages infrastructure, image and Security Hub findings. The MIT Learn team triages findings in MIT Learn repositories.

VM-4. Fix within the remediation timeline.

The clock starts when the finding is reported. A vulnerability that is being actively exploited is handled as a security incident under the Incident Response Policy, and may use the emergency change process (CM-7).

VM-5. Rotate leaked secrets. A secret that was committed, logged or otherwise exposed is treated as compromised. Rotate it, and only then remove it from the code. Removing it from the latest commit doesn't remove it from git history.

VM-6. Fixes go through change management. Fixes are deployed through the normal pipelines (Change Management), and the finding is closed only after the fix is verified in Production (for example, the scanner no longer reports it).

VM-7. Accept risk only with an exception. When a finding won't be fixed within its timeline, or is accepted as a risk, record an exception as described in Policies: Exceptions. The exception names the finding, the compensating control and an expiry no more than six months out. A finding confirmed as a false positive is closed with the evidence recorded.

VM-8. Report on open findings. Platform Engineering reviews open findings, overdue findings and active exceptions at least monthly.

Exceptions

Handled as described in Policies: Exceptions.

Related documents

• Patch Management Policy
• Incident Response Policy
• Change Management Policy
• Compromised Account Response Runbook

Review