Organisational policy that defines the requirements for the configuration, classification, response SLAs, escalation, runbooks and calibration of security and operational alerts, including the prevention of alert fatigue and quality metrics, proportional to the criticality level (L1, L2, L3).
Organisational policy that defines the requirements for the security testing strategy throughout the application lifecycle, including SAST, DAST, SCA, IAST, fuzzing and manual testing, with mandatory gates, finding triage SLAs and centralised management of results, proportional to the criticality level (L1, L2, L3).
Remediation prioritisation layer based on the probability of exploitation (EPSS, FIRST.org) and confirmed exploitation (CISA KEV), applied on top of the CVSS-based patching SLAs. EPSS and KEV refine the order of remediation; the SLAs by severity remain as the mandatory floor.