Technical vulnerabilities belong in your risk program, not in a separate scanner queue nobody looks at. Vulnerability Tracking ties findings from your scanners to the risk register, the owning asset, and the patch window — so compliance has the record §164.308(a)(1) expects.
What it does
- Ingests findings from your vulnerability scanners and ties each to the asset that owns it.
- Applies dated SLAs by severity and auto-escalates when a window expires.
- Promotes material findings to the Risk Register as entries, with treatment plans.
- Produces an audit-ready vulnerability history (open, closed, accepted-with-rationale).
How it maps to HIPAA
Vulnerability work supports §164.308(a)(1)(ii)(A) (risk analysis), §164.308(a)(1)(ii)(B) (risk management), §164.308(a)(5)(ii)(B) (protection from malicious software), and §164.308(a)(6) (security incident procedures) when a vulnerability becomes an incident.
Where it fits
Vulnerability Tracking is a Risk Management module capability, draws asset context from Asset Inventory, and feeds the Risk Register.