AO coverage. Addresses all three Security Alerts & Advisories objectives: response actions are identified, advisories are monitored, and actions are taken.

Response-action catalog [a]. Six outcomes are defined up front so triage is a classification exercise rather than an improvisation: (1) Not applicable — record the reasoning and the inventory query that proves it, then close; (2) Patch on standard SLA — hand to the flaw remediation queue at the mapped severity; (3) Emergency change — 72-hour window for anything exploited in the wild on an internet-facing asset; (4) Mitigate — configuration change, rule, or feature disable when no patch exists yet; (5) Hunt — run the advisory's indicators against historical SIEM data to check for prior exploitation; (6) Notify — inform contracts and, where required, the prime or the customer. An advisory can carry more than one outcome, and “hunt” is mandatory alongside any emergency change.

Monitoring [b]. A named owner and a named backup subscribe to every source, and all of it lands in one shared queue rather than two individual inboxes — the single-analyst inbox is the usual failure point at this size. The queue is reviewed each business day. The KEV list is checked weekly against the software inventory as a scheduled task, so an advisory the organization never received still gets caught.

Applicability. Every advisory is judged against the software and asset inventory, not against memory. If the inventory cannot answer whether a component is present, that is itself a finding routed to the inventory owner, because “we think we don't run that” is not an assessable answer.

Taking action [c]. Each advisory gets a triage record within 2 business days containing the classification, the applicability evidence, the assigned outcome, and the owner. Emergency changes are approved out-of-band by the CISO or IT lead with retroactive change-board review within 5 days. Closure requires evidence: a patch ticket ID, a configuration diff, a hunt query with its result, or the not-applicable inventory query.

Maintenance. Quarterly check that the subscribed source list still covers everything in the software inventory — new platforms arriving without their vendor feed is the common drift. Monthly report of advisory volume, classification mix, and time-to-triage. Annual tabletop exercising an emergency advisory end to end, including the notify path.

Accepted gap. With a two-person function, simultaneous absence is a real risk. The queue is a shared mailbox with an escalation rule that pages the IT lead if an item sits untriaged for 3 days, and the annual review checks whether that rule ever fired.

• Response-action catalog document with the six defined outcomes and their triggers
• Subscription list mapped to the software inventory, with owner and backup named
• Advisory triage records for a recent month showing classification and closure evidence
• One completed emergency change including its hunt query and result
• Escalation rule configuration and the quarterly source-coverage review notes