FlintScope

My Fix-First Rules

Free course · Module 1
What do I fix first?

Business

Filled in by

Date

Review again on

What we don't sort by

Lesson 1

The label or score on an alert (Critical, High, 9.8) does not decide what we fix first.

Our rule:

The gate

Lesson 2

Q1Is someone actually using this attack right now? (CISA KEV list, vendor says so, IT provider says so, or EPSS 0.9+)

Q2Can a stranger on the internet reach the thing with the flaw?

Yes to both: P1 fix within 24 hours.

Decided by:

Who's called, how:

Emergency fixes pre-approved with IT provider · agreed on:

Our top systems

Lesson 3 · money, email, customer data, the thing we can't open without

System	What breaks if it's down or stolen	Owner	Fixes it

The order: Box 1 is always P1. Otherwise Box 2 is P2, Box 3 is P3, Box 4 is P4, and a top system moves a problem up one level. Work P1 first. Inside a level, a top system first, then the score.

Fix deadlines

Lesson 4 · the clock starts when a problem is confirmed and assigned

P1	Box 1	24 hours
P1	Box 2 on a top system	72 hours
P2	Other Box 2; Box 3 on a top system	30 days
P3	Other Box 3; Box 4 on a top system	90 days
P4	Other Box 4	180 days

Missed deadlines go to:

24-hour coverage (how):

Agreed (signature):

Fixed means updated, setting changed, taken off the internet, or removed. A barrier in front can lower a problem one level, never out of Box 1.

Exceptions

Lesson 4 · P1/P2 signed by the owner · expired means overdue again

What isn't being fixed	Why	What we're doing instead	Signed	Expires

flintscope.com/learn · Free to print and share inside your business. Grows into the VM Program Kit's VM Policy, Prioritization Model and Exception Register.