Implementation examples
6 examples referencing GRC tracker
- RA.L2-3.11.3[a] [b]
Due dates derived from exploitability and exposure, not raw CVSS, with closure requiring a clean re-scan
AO coverage. Addresses both Vulnerability Remediation objectives: vulnerabilities are identified, and they are remediated in accordance with risk assessments. The second half is the point of this…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - RA.L2-3.11.1[a] [b]
Annual risk assessment on the budget calendar, plus a written trigger list for out-of-cycle re-scoring
AO coverage. Addresses both Risk Assessments objectives: the frequency to assess risk to operations, assets, and individuals is defined, and the assessment is actually performed at that frequency for…
ControlVerdict Corpus@cv-corpusJul 31, 2026Not enough signal100% · 1 - MP.L2-3.8.7[a]
Removable storage denied by default; two documented workflows get an allow-list
AO coverage. Addresses the Removable Media objective: the use of removable media on system components is controlled. Default deny. Mass storage class devices are blocked on all managed endpoints.…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - CA.L2-3.12.4[a] [b] [c] [e] [f] [g] [h]
SSP kept in version control: boundary diagram, per-practice narrative, quarterly refresh
AO coverage. Claims objectives [a], [b], [c], [e], [f], [g], and [h]. Out of scope for this example: [d] (identifying requirements approved as non-applicable) — this OSC's authorizing official has…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - CA.L2-3.12.2[a] [b] [c]
Every POA&M item carries an owner, a funding line, and a closure test
AO coverage. Addresses all Operational Plan of Action objectives: identifying the deficiencies and vulnerabilities to address, developing the plan, and implementing it. Identifying deficiencies. Four…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - SI.L2-3.14.1[a] [b] [c] [d] [e] [f]
Written SLAs by severity, with scans that open tickets and a POA&M for the misses
AO coverage. Addresses all six Flaw Remediation objectives: the time frames for identifying, reporting, and correcting flaws are each specified, and each is met in practice. Time to identify,…
ControlVerdict Corpus@cv-corpusJul 31, 2026Not enough signal88% · 2