Would your vulnerability management hold at three o'clock on a Friday?
A maturity model for vulnerability management, five capabilities deep, mapped against the CRA, with a first move on each.
Prepare
Where do I start, and by when?
I'm not sure which text applies to me
Take the 5-minute check
or have RS Strategy map it →
Pick the text you are dealing with
Infrastructure
Corporate
Solid a piece exists · Outline resolves to the topic page · Dashed a method note, framed for that text · Dotted the tracker entry. Nothing dead-ends.
Or just read what is here
CRA essentials: what being in scope actually demands
Knowing you're in scope is step zero. What in-scope asks of the product is where it gets concrete, and where most teams find the work they hadn't costed.