5.1.2. Inhibitors to Remediation
💡 First Principle: Vulnerability remediation fails not because organizations don't know what to fix, but because legitimate organizational constraints make fixing it impractical — understanding these constraints is what enables analysts to recommend workable alternatives rather than just repeating "patch immediately."
Real-world vulnerability management constantly encounters friction between security priorities and business realities. These inhibitors are not excuses — they're documented constraints that shape the remediation approach.
| Inhibitor | What It Means | Security Response |
|---|---|---|
| MOU (Memorandum of Understanding) | Formal agreement between parties defining responsibilities — may restrict what changes can be made to a shared system | Escalate to the MOU governing body; update the MOU to require patching |
| SLA (Service-Level Agreement) | Contractual uptime requirements may prohibit taking systems offline for patching | Negotiate maintenance windows into SLAs; implement HA for rolling patches |
| Organizational governance | Change management approval processes, change advisory boards (CABs), may delay patches | Establish emergency change procedures for critical vulnerabilities |
| Business process interruption | Patching requires downtime that affects revenue-generating or mission-critical processes | Schedule during low-impact windows; implement compensating controls until maintenance window |
| Degrading functionality | Some patches break application functionality — vendor testing required before deployment | Coordinate vendor testing; deploy in test environment first |
| Legacy systems | Systems too old to patch (EOL OS, unmaintained custom code, vendor-locked versions) | Network isolation, enhanced monitoring, compensating controls, eventual decommission plan |
| Proprietary systems | Vendor-controlled systems where the organization can't apply patches independently | Require SLA for vendor patching; compensating controls; escalate to vendor |
Recognizing these inhibitors shapes the analyst's recommendation: if a system can't be patched due to legacy constraints, the recommendation isn't "patch it" — it's "isolate it, monitor it closely, and document the accepted risk."
⚠️ Exam Trap: Inhibitors to remediation require documentation and risk acceptance, not just acknowledgment. "We can't patch it because of the SLA" is not a complete response — the risk must be formally accepted by an appropriate authority, compensating controls must be implemented, and the exception must have an expiration date.
Reflection Question: A vulnerability scanner identifies a critical vulnerability in a third-party payment processing application. The vendor says a patch won't be available for 60 days, and the application processes 100% of the organization's payment transactions 24/7. Identify the inhibitor category, the appropriate risk management response, and two compensating controls that could reduce exposure during the 60-day wait.
