Your vulnerability management process needs a documented escalation path for actively exploited flaws. Without one, your team wastes hours debating priorities while attackers move faster.
This template provides a structured decision framework for handling CISA Known Exploited Vulnerabilities catalog additions and similar high-urgency patches. It includes the questions you need to answer, the stakeholders who need to sign off, and the communication scripts that prevent confusion during emergency patching.
Purpose of the Template
Use this template when a vulnerability meets any of these criteria:
- Added to CISA's Known Exploited Vulnerabilities catalog
- Confirmed active exploitation in your industry or geography
- Chained with other vulnerabilities to bypass authentication or escalate privileges
- Affects internet-facing systems or administrative interfaces
The template creates a single document that outlines your decision, timeline, and fallback plan. Attach it to your change request and reference it in stakeholder communications.
Prerequisites
Before using this template, ensure you have:
- An accurate asset inventory showing which systems run the affected software
- Defined patch windows or an emergency change process
- Named decision-makers for production changes
- A rollback procedure for each affected system type
If any of these are missing, document the gap in the template's Risk Acceptance section. Address this gap as your first remediation item after dealing with the immediate vulnerability.
The Template
EMERGENCY PATCH DECISION RECORD
Date Opened: [YYYY-MM-DD]
Decision Owner: [Name, Title]
Vulnerability Reference: [CVE number or vendor advisory ID]
VULNERABILITY SUMMARY
Affected Products: [List specific versions]
CVSS Score: [Number]
Exploitation Status: [Active exploitation confirmed / CISA KEV addition / Proof-of-concept published]
Attack Complexity: [Authentication required? / Network access? / User interaction?]
Potential Impact: [Privilege escalation / Data exfiltration / System control / Denial of service]
ASSET EXPOSURE ASSESSMENT
Total Affected Assets: [Number]
Internet-Facing: [Number]
Contains Sensitive Data: [Number]
Business-Critical: [Number]
Compensating Controls in Place: [List or "None"]
PATCHING DECISION
☐ Emergency patch within 24 hours
☐ Accelerated patch within [X] business days (justify below)
☐ Risk accepted with compensating controls (requires executive sign-off)
Justification:
PATCH TIMELINE
Vendor Patch Available: [Yes/No, release date if known]
Testing Window: [Start date - End date]
Production Deployment: [Start date - End date]
Validation Complete By: [Date]
If patching cannot meet CISA deadline or industry standard timeline:
Reason:
Compensating Controls:
Executive Approver:
Re-evaluation Date:
STAKEHOLDER NOTIFICATION
Technical Teams Notified: [Date, method]
Business Unit Owners Notified: [Date, method]
Executive Leadership Notified: [Date, method]
Board Notification Required: [Yes/No]
ROLLBACK PLAN
Rollback Decision Criteria:
Rollback Owner:
Rollback Procedure Location:
Estimated Rollback Time:
POST-PATCH VALIDATION
☐ Patch applied successfully to all systems
☐ Services restored to normal operation
☐ No unexpected side effects observed
☐ Vulnerability scanner confirms remediation
☐ Lessons learned documented
LESSONS LEARNED (complete within 5 business days)
What delayed our response:
What accelerated our response:
Process improvements needed:
Tool gaps identified:
Customizing the Template
For federal agencies or contractors: Add the specific CISA Binding Operational Directive deadline. Federal Civilian Executive Branch agencies face enforcement action for missing KEV deadlines, so adjust the Risk Acceptance section accordingly. Replace "Executive Approver" with "Authorizing Official" and reference your NIST SP 800-37 continuous monitoring plan.
For healthcare organizations: Include a HIPAA Security Rule impact assessment. If the vulnerability affects systems with Protected Health Information, document whether you're invoking your breach notification procedure. Note your covered entity or business associate status.
For financial services: Reference your third-party risk management program if the vulnerability affects a vendor-managed system. Trigger a vendor attestation request and update your vendor risk register.
For organizations without 24/7 operations: Adjust your timeline expectations. If you can't deploy emergency patches outside business hours, focus on compensating controls. Document network segmentation, access restrictions, or temporary service shutdowns.
For multi-tenant SaaS providers: Add a customer communication section. Specify which customers you'll notify, what information you'll share, and whether you're required to report the incident under your service agreement.
Validation Steps
After completing the template, verify:
Timeline realism: Can your team meet the dates listed? If CISA set a deadline of September 13 and it's September 10, you need a different plan than one with three weeks' notice.
Authority alignment: Does the decision owner have the authority to approve production changes? If not, add the actual decision-maker and clarify the template owner's role as coordinator.
Communication completeness: Did you notify everyone who needs to know? For the ConnectWise ScreenConnect flaw affecting client systems, your help desk needs talking points before users start calling about unexpected updates.
Compensating control adequacy: If deferring a patch, are your compensating controls reducing risk? Saying "we have a firewall" doesn't address a privilege escalation vulnerability that attackers reach after initial access.
Rollback preparedness: Can you execute your rollback plan at 2 AM if the patch breaks production? If not, adjust your deployment timeline.
Test this template during your next Tabletop Exercise. Give your team a scenario where CISA adds a vulnerability affecting your environment to the KEV catalog on a Friday afternoon. Identify where they get stuck. Those friction points tell you which sections need more detail or which prerequisite processes you need to build.
The template works because it forces decisions at the right time. You're not debating patch priority while attackers are exploiting the vulnerability. You're executing a decision framework you built when you had time to think clearly.
