Include vulnerability remediation SLAs

handbook/security/human-and-incident-management/incident-response-management.md

@@ -13,6 +13,15 @@ description: Incident response management is a set of procedures that an organiz
 
 In case of an incident, urgently report it to [[email protected]](mailto:[email protected]). The incident response team will take it from there.
 
+## Vulnerability remediation SLAs
+
+To ensure a swift and effective response to vulnerabilities, we have established the following SLAs for remediation based on severity:
+
+- **Critical Vulnerabilities:** These vulnerabilities are addressed within **24 hours** of identification. Immediate action is taken to mitigate risks that could significantly impact systems, users, or data.
+- **High Vulnerabilities:** These vulnerabilities are addressed within **72 hours** of identification. Prompt action is taken to reduce the likelihood of exploitation.
+
+These timelines are integrated into our incident response process to ensure timely remediation and minimize potential risks.
+
 ## Plan
 
 You can find the incident response plan in the [Incident Response Plan](/pdfs/security/human-and-incident-management/incident-response-plan-bsi.pdf) document.