Vulnerability Scan Analysis & Remediation Plan

Area

Vulnerability Management

Framework

NIST 800-53 RA/SI families

Controls

RA-5 — Vulnerability Monitoring & Scanning, RA-2 — Security Categorization, SI-2 — Flaw Remediation, RA-3 — Risk Assessment

What I did

Analyzed a Nessus scan of 120 fictional assets at Midwest Freight Logistics (1,400+ findings). I removed duplicates and false positives, then prioritized by CVSS, EPSS and the CISA KEV catalog together with asset criticality, cutting the urgent work to 38 critical findings. I built a remediation plan with owners and 15/30/90-day SLAs, plus a Power BI dashboard tracking open findings, aging and SLA compliance.

What I learned

Severity is not the same as risk. A medium-severity finding on an internet-facing server with a known exploit outranks a critical one on an isolated test box.