Free service guide · PDF

The Vulnerability Management Starter Guide

How to find, rank and fix security weaknesses on a schedule a small team can keep

The vulnerability management cycle in plain English
An asset inventory template and a starter scanning schedule
A simple method for ranking findings by real risk
Remediation and exception templates, a checklist and a 90-day plan

13 pages25-item checklist30/60/90-day plan

Cover of The Vulnerability Management Starter Guide

Get your free copy

Instant PDF download. No sales pitch inside.

Cover and two sample pages of The Vulnerability Management Starter Guide, a free 13-page PDF guide from Alpiba with a 25-point checklist — A look inside: the cover and two pages from the 13-page PDF.

What's inside

Inside the guide.

Vulnerability management is the routine of finding security weaknesses, deciding which ones matter, fixing them and proving they are fixed. Large companies have whole teams for it. A growing business needs the same routine at a smaller scale: a current inventory, regular scans, a short ranked list and someone accountable for working through it.

Read the cycle first, then build your inventory, set the schedule and agree your ranking rules. The templates are meant to be copied into a spreadsheet or ticketing system. If you only do one thing this month, build the inventory, because everything else depends on it.

The cycle in plain English
Build your asset inventory first
Set up scanning
Rank findings by real risk
Fix, verify and keep the evidence
The checklist25 items in 4 groups
Questions to ask any IT provider10 questions
Your 30/60/90-day plan3 phases, step by step
Plain-English glossary8 terms

Read Part 1 free

The opening chapter of the guide, in full. The rest of the guide, the checklist and the 90-day plan are in the PDF.

The cycle in plain English

Inventory
Know what you have: devices, servers, cloud services, internet-facing systems and the software they run.
Scan
Check those assets for known weaknesses, from outside the network and inside it.
Prioritize
Rank findings by exposure, real-world exploitation and business impact, not by severity score alone.
Fix
Patch, reconfigure, isolate or retire, with an owner and a target date for every item.
Verify
Re-scan to confirm each fix actually worked.
Report
Keep a record of what was found, fixed and accepted, and review it with leadership.

The cycle never finishes. New vulnerabilities are published every day, and your environment changes every month. The goal is a steady rhythm you can sustain, not a perfect score.

Decide who does what before you start. A simple split works: one person, often the office manager or IT lead, owns the process and the log; your IT provider or internal team runs the scans and the fixes; leadership approves exceptions and reads the quarterly summary.

Get the full guide

A preview

A sample from the guide.

Here's the first checklist group and a few of the questions. The full guide has all 25 checklist items, 10 questions and the 90-day plan.

Inventory and scope

Asset inventory created with an owner, location and data type for each item
Every public IP address and domain listed
Cloud services and admin consoles included in scope
Printers, cameras and specialist equipment included
Unsupported systems identified, each with a replacement or isolation plan
Written approval for scanning in place

Questions to ask any IT provider

1What exactly is in scope: external, internal, cloud and key applications?
2Are internal scans credentialed, and how is that account protected?
3How do you rank findings beyond the CVSS score?
4What happens to lab, imaging or production equipment that can't tolerate an aggressive scan?

+ 6 more questions in the full guide

Get the full guide Related: Vulnerability Assessments

Vulnerability Assessments at a glance. Included: Internal & external scanning, Cloud configuration review, Patch gap analysis, Prioritized findings, Remediation plan and Fix support. How it works: Discovery & Analysis, Solution Design, Implement and Protect & Optimize. — Vulnerability Assessments at a glance: what is included and how we roll it out.

Your first 30 days

Where to start this month.

The guide's 30/60/90-day plan begins with these steps. Assign an owner to each and review progress every two weeks.

1Build the asset inventory, starting with internet-facing systems
2List every domain and public IP address you own
3Write down ranking rules and remediation targets
4Run a first external scan and fix anything urgent

Key terms in plain English

Vulnerability: A weakness in software, hardware or configuration that an attacker could use to gain access or cause harm.
CVE: Common Vulnerabilities and Exposures: a public ID for a specific known vulnerability, so everyone can refer to it the same way.
CVSS: Common Vulnerability Scoring System: a 0–10 severity score that describes a vulnerability in general, not the risk to your business.
Known Exploited Vulnerabilities (KEV) catalog: A free list from the U.S. Cybersecurity and Infrastructure Security Agency (CISA) of vulnerabilities seen in real attacks.
Credentialed scan: A scan that signs in to each device with a dedicated scanning account, giving accurate patch and configuration data.
Attack surface: Everything an attacker could try to reach, from internet-facing systems to user accounts and cloud settings.
Compensating control: A safeguard, such as network isolation or extra monitoring, that reduces risk when a direct fix isn't possible yet.
End of support: The date after which a vendor stops releasing security fixes for a product.