The risk team wants residual context from how long critical vulnerabilities sit open—without turning the item into a Vulnerability Response implementation. Which configuration fits?
Select an answer to reveal the explanation.
Short Explanation
Think of vuln backlog age as a thermometer reading plugged into the risk record—not a full clinic rebuild. Configure an indicator for that signal and leave Vulnerability Response to handle remediation work.
Full Explanation
IRM indicators can consume platform or security backlog signals for risk context at a purpose level. Configuring an automated indicator on vulnerability backlog age informs residual discussion without implementing CIS-VR depth. Absorbing VR workflows, replacing risk owners, or discarding qualitative assessment misplace product boundaries.