Vulnerability Management Monitors
Track and resolve vulnerability management checks in Sprinto, including VAPT tracking and resolution workflows.
The Vulnerability Management Monitors section in Sprinto helps ensure that your organisation is actively identifying, tracking, and resolving vulnerabilities in a timely and auditable manner. These checks ensure compliance with vulnerability management requirements across major frameworks such as:
SOC 2 (CC7.1, CC7.2)
ISO 27001 (A.12.6.1, A.18.2.3)
PCI DSS 6.1, 11.2
HIPAA Security Rule
Sprinto tracks both automated scan results and evidence of periodic manual reviews (e.g. quarterly VAPT audits) to confirm whether your vulnerability management program is operating effectively.
What does Sprinto monitor?
Vulnerabilities must be resolved in a timely manner
Tracks whether critical and high-risk issues have been closed within SLA
Periodic VAPT reports must be uploaded
Checks if a vulnerability scan report has been uploaded for the last cycle
Outdated evidence or no audit trail for resolution
Flags missing documentation or lack of audit log evidence
Monitors and How to Resolve Them
1. VAPT Vulnerability Should Be Resolved
Go to Vulnerabilities > Active Findings in Sprinto
Filter by Status: Open and Severity: High/Critical
Resolve findings or mark as accepted risk (with justification)
Upload closure evidence (e.g. screenshots, logs, patch confirmation)
2. Periodic VAPT Report Must Be Uploaded
Navigate to Evidence > Vulnerabilities or Audit Evidence
Upload the latest penetration test report (e.g. PDF or CSV)
Report must include:
Date of scan
Scope of scan (IPs, assets, systems)
Risk classification and remediation summary
Ensure the report is from the last quarter or half-year, as per your policy
Evidence Guidelines
VAPT report
Yes
Must include scan date, scope, severity distribution, remediation log
Remediation screenshots/logs
Yes
Patches applied, firewall rules added, configurations fixed
Risk acceptance record
Optional
Justification and review by InfoSec if vulnerability cannot be fixed
Tips
Assign owners to each vulnerability to track accountability
Maintain a central vulnerability tracker if you use third-party scanning tools
Sprinto supports auto-remediation checks if integrated with supported scanners
Last updated