diff --git a/security/overview.md b/security/overview.md index 214de58e46..6a8d412147 100644 --- a/security/overview.md +++ b/security/overview.md @@ -35,7 +35,7 @@ We value the contributions of security researchers and ethical hackers. If a res |------------------|------------------------| | First Response | 7 days | | Time to Triage | 10 days | -| Time to Resolution| Depends on severity | +| Time to Resolution| [Depends on severity](#vulnerability-remediation-guidelines) | For more information, visit: @@ -43,6 +43,15 @@ For more information, visit: - [Progress Trust Center](https://www.progress.com/trust-center) - [Vulnerability Reporting Policy](https://www.progress.com/trust-center/vulnerability-reporting-policy) +## Vulnerability Remediation Guidelines + +Progress follows defined timelines for remediating vulnerabilities based on their severity level, ensuring a structured and efficient approach to maintaining security across all products. These guidelines are aligned with the CVSS (Common Vulnerability Scoring System) scoring: + +- **Critical score issues (CVSS 9.0+):** Resolved within **30 days**. +- **High score issues (CVSS 7.0–8.9):** Resolved within **60 days**. +- **Medium or lower score issues (CVSS < 7):** Resolved within **90–120 days**, depending on the score. + +While these are not strict SLA (Service Level Agreement), they serve as a commitment to providing timely resolutions for identified vulnerabilities. ## What We Do to Mitigate Risk