A director can test a vulnerability management program with a few plain questions: what do we run, what is being exploited that we run, how long do fixes take, what is overdue and why, who owns it, how do we know it is working, and what do you need from us. Good answers are specific and dated.
The seven questions
1. Do we know everything we run? Listen for an inventory of applications and components and a statement of what share is covered. Probe: how is it kept current?
2. Are any known exploited vulnerabilities present in what we run? CISA maintains the Known Exploited Vulnerabilities catalog and recommends using it as an input to prioritization. A good answer says how many matched items exist, which are reachable, and when they will be closed. "Zero" is acceptable only with an explanation of how it was checked.
3. How long does it take us to fix important issues? A good answer gives a median per priority tier, with the longest open item named. If only an average is given, ask for the median and the oldest.
4. What is overdue and why? The answer should include a count, the oldest items, and the cause, such as missing owners, blocked upgrades or capacity.
5. Who is accountable for each system? Ask for the share of findings with a named owner. A low share predicts long delays.
6. How do we know the process works? Look for specifics: sampling, independent testing, audit evidence, or a recorded exception process. Avoid answers that reference only tool dashboards.
7. What do you need from us? Expect one concrete ask or a clear "nothing this quarter".
What good and weak answers sound like
| Question | Good answer | Weak answer |
|---|---|---|
| Inventory | Source, coverage share, refresh frequency | "We use a scanner" |
| Exploited items | Count, reachability, dates | "Nothing critical" |
| Fix speed | Median per tier, oldest item | "Fast" |
| Overdue | Count, cause, plan | "In progress" |
| Ownership | Share with owner, plan for the rest | "Teams know" |
Follow ups that surface real issues
- "Show me the oldest open priority one item and who owns it."
- "What changed in how you count since last quarter?"
- "Which numbers are you least sure about?"
- "What would you do with more resources?"
These invite candor. A program that cannot name its uncertain numbers probably has not examined them.
What the answers cannot tell you
A report is a summary. Directors cannot verify details and should not try. They can assess whether answers are consistent from quarter to quarter and whether the team names its own gaps. For an overview see how to answer board cybersecurity questions.
Safeguard's asset discovery, dependency scanning and compliance evidence automation can support the answers above, and its free scan shows how a component inventory is presented.
Try it yourself
Click through it at your own pace, or open it full screen.
Watch how findings change after release and decide which of the seven questions the screen helps answer.
Quick check
How often should a board ask these?
Quarterly is typical, with the team reporting consistent measures so trends are visible.
Should directors ask for raw finding counts?
Counts are fine if explained with trend and age. A raw count alone says little.
Sources
- CISA, Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
Last reviewed: 19 October 2026.
