Direct answer
Use remediation age as a prompt for review, alongside applicability, business impact, owner and status. Separate verified fixes, pending work, exceptions and unavailable assets so a single average does not conceal unresolved exposure.
Define the clock
Agree whether age begins at detection, validation or owner notification, and record the chosen dates. For a vendor issue reported before applicability was known, preserving both detection and confirmation dates gives a clearer history than changing the start date silently.
Reference: NIST SP 800-137: Information Security Continuous Monitoring.
Segment meaningful work
Group issues by service owner, affected environment and status. A high-priority internet-facing production issue may require a different response from a low-impact isolated test system. Keep unverified alerts separate from confirmed findings and time-limited risk exceptions.
- Include an owner and next action for each issue.
- Count devices or services still unavailable for verification.
- Record the review date for exceptions.
Use the metric to ask questions
If a group of findings is aging, determine whether the cause is ownership, a vendor dependency, compatibility or limited access. The metric should support resource and risk decisions, not encourage premature closure or misclassification.
Reference: NIST SP 800-137: Information Security Continuous Monitoring.
Verify closure
Record deployment and retest separately, and use the verified closure date under the agreed policy. Report unresolved and inconclusive items alongside the average. Review how the metric changes after scope or detection rules change.
Assessment limits
Aging is not a complete risk score. Changes in inventory, detection and reporting can affect trends; use consistent definitions and inspect individual high-impact cases.
Frequently asked questions
Is the oldest issue always the highest priority?
No. Consider exposure, business impact, evidence and current threat context as well as age.
Should an exception stop the clock?
Define the policy explicitly and keep the underlying issue and exception expiry visible in the report.
Primary sources and further reading
These guides combine published security guidance with practical assessment planning. Adapt checks to the owner's policy, environment, and authorized scope.
This guide was prepared with AI assistance using the linked sources and illustrative examples. Check current vendor guidance and your environment before making changes.