Known Exploited Vulnerabilities That Remain Unremediated Could Put the IRS Network at Risk

Timely remediate all KEVs in accordance with the time frames set forth in the CISA’s KEV Catalog.

In accordance with the directive, immediately isolate or remove from the network all assets with KEVs not remediated by the established due date.

The Chief Information Officer should assess attack signature changes to determine remediation time frames for each, and update data in the asset and vulnerability repository that include signature change dates applicable to KEVs and the remediation time frame allowed for each signature change as assessed.

The Chief Information Officer should finalize standard operating procedures on internal vulnerability management and update the Internal Revenue Manual.