CISA KEV Correlation

Components checked against CISA Known Exploited Vulnerabilities catalog.


Short name	KEV
Region	Internal
Country or scope	Internal
Sector	Supply Chain
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers KEV

Scan requirements: 1, all decided by a scan.
Controls: the scan requirements below, plus 8 controls from Safeguard's control catalog for KEV.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 25: 3 written for KEV and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these requirement against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`KEV-1` No Actively Exploited Vulnerabilities	No components matched entries in the CISA Known Exploited Vulnerabilities catalog	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`KEV-01`	KEV Catalog Correlation
`KEV-02`	Remediation Due-Date Tracking
`KEV-03`	Patch SLA Compliance
`KEV-04`	KEV Exception Process
`KEV-05`	KEV Feed Freshness
`KEV-06`	KEV Scope Coverage: All Ecosystems
`KEV-07`	Vulnerability Disclosure Notification
`KEV-08`	Post-Patch Verification

Policy templates

Written for KEV:

CISA KEV Response SLA Policy
KEV Exception and Risk Acceptance Policy
KEV Feed Management and Data Freshness Policy

And 22 from the standard set, adapted to KEV.