# Remediation deadlines and SLAs

In SecOps, an SLA is the time your organisation allows to fix a finding of a given severity. This guide explains how the deadline is calculated and how to interpret **Due in** and **Breached**.

## What does SLA mean here?

SLA stands for service level agreement. In this app it names your internal remediation deadline, rather than a contractual availability guarantee or a legal patching requirement. A standard or contract may impose different obligations; changing the app's setting does not change those obligations.

## The default time to fix

| Severity | Default allowance from discovery |
| --- | --- |
| Critical | 30 days |
| High | 90 days |
| Medium | 180 days |
| Low | 365 days |
| Info | No SLA |

These are app defaults, not recommended waiting periods. An exposed or actively exploited issue can need action much sooner. Admins can set each dated severity to between 1 and 3,650 days in **Settings → Time to fix, by severity**.

## When does the clock start?

Normally it starts when the source first discovered the finding. Importing an old finding does not give it a fresh allowance just because SecOps saw it today.

For example, a critical finding discovered 40 days ago with a 30-day allowance is about ten days past its deadline. Check the discovery date when an imported backlog immediately shows breaches.

**Due in 0 d** means due today. It becomes breached when the computed days left is negative. Info findings have no deadline, so **No SLA** is different from being overdue.

## Changes and exceptions

Changing a severity's allowance affects the derived findings after the next model run. Review the draft before applying: a shorter deadline can make existing findings overdue, and a longer one can remove a breach without fixing the issue.

An active risk-acceptance or false-positive exception temporarily changes whether the finding counts as open. After its recheck date passes, a finding still reported open by the source reopens with the deadline restarted from that date. See [Exceptions](/docs/secops/exceptions) for the exact boundaries.

## What to do with a breach

Open the finding, confirm the affected target and owner, and decide how to reduce the risk. Use [fix groups](/docs/secops/remediation) to avoid creating separate work for issues one change can address.

A deadline measures timeliness of response. It does not measure whether exploitation occurred, and meeting it does not prove the target is secure.

## Learn more

- [Vulnerabilities, severity and exploit likelihood](/docs/secops/vulnerabilities)
- [CISA's Known Exploited Vulnerabilities catalogue](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)