SAST Severity and SLA Matrix
A configurable SAST severity and SLA matrix that separates scanner severity from business priority and defines deadlines, escalation, verification, and exception handling.
Primary question: How should an organization map SAST findings to remediation SLAs, escalation rules, and exceptions?
Direct answer
A useful SAST SLA matrix combines technical severity with application context and explicit governance
Preserve scanner severity as source evidence, then derive remediation priority using documented contextual factors. Do not silently overwrite severity when business context changes the treatment of a finding. [nist-ssdf]
Define each SLA with a start event, target state, clock basis, escalation owner, verification requirement, and exception process. Calendar values are organizational policy choices and should be validated against risk tolerance and delivery capacity. [owasp-devsecops]
Definitions
Scanner severity
The tool-assigned estimate of technical seriousness for a finding under the scanner's rule model.
Remediation priority
The organization-assigned order for addressing a finding after considering technical impact, exposure, asset criticality, reachability, and policy.
Remediation SLA
The approved time boundary for reaching a defined finding state, measured from a documented start event and subject to explicit pause and exception rules.
The engineering problem
A severity-only deadline can over-prioritize unreachable findings while delaying lower-severity weaknesses in exposed or critical applications.
An SLA percentage is not reproducible when teams use different start dates, pause rules, closure states, or reopened-finding treatment.
Security controls
Each control inspects a different artifact and produces evidence for an engineering decision.
Context adjustment rubric
SAST priority rubric- Artifact
- A scored or rule-based worksheet covering exposure, data sensitivity, application criticality, reachability, exploit prerequisites, compensating controls, and policy obligations.
- Risk
- Priority changes depend on undocumented analyst judgment.
- Output
- A contextual priority with the factors and approver recorded.
Configurable SLA matrix
SAST remediation SLA table- Artifact
- A table with priority bands as rows and columns for example target window, start event, target state, escalation cadence, verification, and executive exception authority.
- Risk
- Deadline reporting appears precise while teams apply incompatible definitions.
- Output
- One approved policy table implemented consistently in workflow systems.
Evidence: OWASP DevSecOps Guideline
Starter policy artifact
Illustrative SLA matrix- Artifact
- Critical: organization-defined shortest window and immediate ownership; High: next-shortest window and weekly review; Medium: planned release window; Low: backlog or risk-based window. Replace all windows with approved calendar or business-day values.
- Risk
- Copying arbitrary industry deadlines without considering organizational risk tolerance or remediation capacity.
- Output
- A workshop-ready matrix whose timing fields are intentionally marked for local approval.
Evidence:
Exception and breach register
SLA governance register- Artifact
- A record of extensions, accepted risks, blocked fixes, compensating controls, expiry dates, breach reasons, owners, and approvals.
- Risk
- Exceptions become permanent or SLA performance improves by administratively closing unresolved risk.
- Output
- Reviewable exceptions and attributable breach causes.
Verification workflow
- Define the finding event that starts the clock, such as triage confirmation or initial report.
- Define target states separately for remediation complete, fix verified, risk accepted, and false-positive rejection.
- Select calendar days or business days and document timezone, pause, reopening, and inherited-finding rules.
- Preserve the scanner severity and rule metadata.
- Apply the approved context rubric to derive remediation priority.
- Assign an engineering owner and escalation owner when the SLA starts.
- Track elapsed and paused time from immutable workflow timestamps.
- Require verification evidence before counting a remediated finding as complete.
- Route extensions through the exception register with an expiry and named approver.
- Review breaches by cause and adjust capacity, workflow, or policy without rewriting historical results.
DerScanner · Enterprise
Relationship to DerScanner
DerScanner output can supply finding data to an organization-defined severity, priority, and SLA policy.
DerScanner documentation is the authoritative public source for product capabilities that should be checked when mapping scanner fields and workflows into an SLA implementation. [derscanner-docs]
Limits of verification
- No universal remediation deadline fits every organization, application, weakness, or regulatory environment.
- Scanner severity and generic weakness ratings do not by themselves establish exploitability or business impact.
- A fast closure metric can conceal accepted risk, duplicate closures, or inadequate verification unless states are reported separately.
- Context rubrics can create false precision; retain analyst reasoning and permit controlled escalation.
- This matrix is engineering governance guidance, not legal or regulatory advice.
Related knowledge
SAST Triage Playbook
Produce the validity and context inputs used by the SLA matrix
Relationship: related-toSAST Rollout Plan
Pilot SLA policy before portfolio-wide enforcement
Relationship: related-toSAST Tool Requirements Checklist
Require the metadata and workflow support needed for SLA reporting
Relationship: related-toSAST Evaluation and Deployment Toolkit
Connect SLA governance to evaluation and deployment
Relationship: related-toCanonical terms used: SAST severity matrix; SAST remediation SLA; vulnerability remediation deadline; SAST priority rubric; finding SLA policy.
Evidence and references
- NIST Secure Software Development FrameworkThe SSDF describes identifying, recording, tracking, prioritizing, and remediating vulnerabilities using risk-based processes.
nist-ssdf - OWASP DevSecOps GuidelineThe guideline addresses security activities, testing, and feedback within software delivery processes.
owasp-devsecops - OWASP SAMM Security TestingOWASP SAMM frames security testing as a repeatable practice that can be scaled and integrated with development.
owasp-samm-security-testing - DerScanner documentationDerScanner publishes product documentation for evaluators and implementers.
derscanner-docs
Define measurable remediation policy