Security questionnaire answers › Infrastructure
How do you identify and patch vulnerabilities? How to answer it in a security questionnaire
Why buyers ask this
Buyers check that known flaws are found quickly and fixed within defined timeframes.
What a strong answer includes
- Cover code, dependencies, containers and infrastructure scanning.
- State remediation SLAs by severity.
- Describe how emergency patches are handled.
Sample answer to adapt
Replace the bracketed parts with your own facts. Only state what is true for your environment.
We run automated dependency, container and infrastructure scans [continuously/weekly] and static analysis in CI. Findings are triaged by severity and remediated within [critical 7 days, high 30 days, medium 90 days]. Out-of-band patches are applied for actively exploited vulnerabilities.
Evidence to attach
- Scanner configuration or recent report
- Vulnerability management policy
- Remediation SLA record
Common mistakes
- No stated SLA.
- Scanning production only and not dependencies in code.
Answer questionnaires from your own documents
Korrali Trust drafts answers from your policies and evidence so every response traces back to its source, and a person reviews it before it goes out.