Remediation Policy

​

Remediation Policy

Remediation Policy lets your organization automatically exclude low-risk or non-actionable vulnerabilities from remediation. When the policy is enabled, Backline automatically moves vulnerabilities that match the selected rules to Dismissed. These vulnerabilities will not be remediated and will not appear in active remediation queues. You can find this page under: Settings → Remediation Policy

​

How the Policy Works

Remediation Policy includes four optional rules: The Risk Score Threshold rule uses the Risk Score shown on the vulnerability, which already includes the business criticality adjustment.

​

Application Business Criticality Rule

Select one or more business criticality levels: Critical, Standard, Non critical, and Not set. Backline dismisses vulnerabilities that belong to an application with any of the selected levels.

• A matching vulnerability is dismissed regardless of its Risk Score, severity, reachability, or exploitability.
• With no levels selected, the rule dismisses nothing and does not count as an enabled rule.
• Vulnerabilities that are not linked to any application are never dismissed by this rule, even when Not set is selected.
• Selecting Not set, or all four levels, dismisses every vulnerability on every matching application.

When you save, the rule applies to existing vulnerabilities as well as new ones. Vulnerabilities already assigned to a remediation are never dismissed.

​

When Dismissed Vulnerabilities Return to Open

A vulnerability dismissed by the policy returns to Open automatically once it no longer matches any enabled rule — for example, when you remove a level from the rule, or when an application’s business criticality changes to a level that is no longer selected. Changing an application’s business criticality re-applies the policy to its vulnerabilities in both directions. Vulnerabilities that a person dismissed manually are never reopened by the policy, and Resolved vulnerabilities are never changed.

​

Enabling or Disabling the Policy

Use the main toggle at the top of the page to turn Remediation Policy on or off. When the policy is off, Backline will not automatically dismiss vulnerabilities based on these rules, and vulnerabilities it previously dismissed return to Open. Your saved rule settings remain visible, but cannot be edited until the policy is turned back on. While the policy is on, at least one rule must be enabled to save.

​

Saving Changes

After changing the policy settings, click Save to apply the changes. You can click Cancel to discard your changes and restore the last saved policy configuration.