Critical vulnerability remediation with independent verification

Require application testing, infrastructure verification and security retest before closing a vulnerability. Editable collaboration with role lanes, decisions and independent parallel checks. Illustrative policy and timing; adapt to local requirements.
BPMN 2.0Risk & Reliability BPMN 2.0 syntax docs
Template previewBPMN 2.0
Rendering…
What this template contains

Source: 87 lines
Make it your own.

<?xml version="1.0" encoding="UTF-8"?>
<bpmn:definitions xmlns:bpmn="http://www.omg.org/spec/BPMN/20100524/MODEL" xmlns:bpmndi="http://www.omg.org/spec/BPMN/20100524/DI" xmlns:dc="http://www.omg.org/spec/DD/20100524/DC" xmlns:di="http://www.omg.org/spec/DD/20100524/DI" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" id="critical_vulnerability_definitions" targetNamespace="urn:flowss:advanced">
  <bpmn:message id="critical_vulnerability_message" name="Critical finding confirmed"/>
  
  <bpmn:process id="critical_vulnerability_process" name="Critical vulnerability remediation with independent verification" isExecutable="false">
    <bpmn:documentation>Require application testing, infrastructure verification and security retest before closing a vulnerability. Inputs: Critical finding confirmed. All policy choices, durations and conditions are illustrative. Replace example rules with approved local policy; configure integrations and review before execution. This non-executable template does not assert legal compliance or a real completed case.</bpmn:documentation>
    <bpmn:laneSet id="critical_vulnerability_lanes"><bpmn:lane id="critical_vulnerability_lane_0" name="Application owner"><bpmn:flowNodeRef>critical_vulnerability_start</bpmn:flowNodeRef><bpmn:flowNodeRef>critical_vulnerability_intake_1</bpmn:flowNodeRef><bpmn:flowNodeRef>critical_vulnerability_split</bpmn:flowNodeRef><bpmn:flowNodeRef>critical_vulnerability_check_0_1</bpmn:flowNodeRef><bpmn:flowNodeRef>critical_vulnerability_check_0_2</bpmn:flowNodeRef><bpmn:flowNodeRef>critical_vulnerability_join</bpmn:flowNodeRef><bpmn:flowNodeRef>critical_vulnerability_decision</bpmn:flowNodeRef><bpmn:flowNodeRef>critical_vulnerability_success_1</bpmn:flowNodeRef><bpmn:flowNodeRef>critical_vulnerability_success_rest_1</bpmn:flowNodeRef><bpmn:flowNodeRef>critical_vulnerability_complete</bpmn:flowNodeRef></bpmn:lane><bpmn:lane id="critical_vulnerability_lane_1" name="Infrastructure owner"><bpmn:flowNodeRef>critical_vulnerability_check_1_1</bpmn:flowNodeRef><bpmn:flowNodeRef>critical_vulnerability_check_1_2</bpmn:flowNodeRef></bpmn:lane><bpmn:lane id="critical_vulnerability_lane_2" name="Security validator"><bpmn:flowNodeRef>critical_vulnerability_check_2_1</bpmn:flowNodeRef><bpmn:flowNodeRef>critical_vulnerability_check_2_2</bpmn:flowNodeRef><bpmn:flowNodeRef>critical_vulnerability_exception_1</bpmn:flowNodeRef><bpmn:flowNodeRef>critical_vulnerability_exception_rest_1</bpmn:flowNodeRef><bpmn:flowNodeRef>critical_vulnerability_alternate</bpmn:flowNodeRef></bpmn:lane></bpmn:laneSet>
    <bpmn:startEvent id="critical_vulnerability_start" name="Critical finding confirmed"><bpmn:messageEventDefinition id="critical_vulnerability_start_def" messageRef="critical_vulnerability_message"/></bpmn:startEvent>
    <bpmn:userTask id="critical_vulnerability_intake_1" name="Register affected assets"></bpmn:userTask>
    <bpmn:parallelGateway id="critical_vulnerability_split"></bpmn:parallelGateway>
    <bpmn:userTask id="critical_vulnerability_check_0_1" name="Patch application dependency"></bpmn:userTask>
    <bpmn:userTask id="critical_vulnerability_check_0_2" name="Run regression suite"></bpmn:userTask>
    <bpmn:userTask id="critical_vulnerability_check_1_1" name="Patch host exposure"></bpmn:userTask>
    <bpmn:userTask id="critical_vulnerability_check_1_2" name="Check external reachability"></bpmn:userTask>
    <bpmn:userTask id="critical_vulnerability_check_2_1" name="Retest exploit conditions"></bpmn:userTask>
    <bpmn:userTask id="critical_vulnerability_check_2_2" name="Review residual risk"></bpmn:userTask>
    <bpmn:parallelGateway id="critical_vulnerability_join"></bpmn:parallelGateway>
    <bpmn:exclusiveGateway id="critical_vulnerability_decision" name="Exposure removed?" default="critical_vulnerability_flow_14"></bpmn:exclusiveGateway>
    <bpmn:userTask id="critical_vulnerability_success_1" name="Approve closure evidence"></bpmn:userTask>
    <bpmn:userTask id="critical_vulnerability_exception_1" name="Apply compensating controls"></bpmn:userTask>
    <bpmn:userTask id="critical_vulnerability_success_rest_1" name="Update asset risk record"></bpmn:userTask>
    <bpmn:userTask id="critical_vulnerability_exception_rest_1" name="Reopen remediation task"></bpmn:userTask>
    <bpmn:endEvent id="critical_vulnerability_complete" name="Finding closed"></bpmn:endEvent>
    <bpmn:endEvent id="critical_vulnerability_alternate" name="Residual risk retained"></bpmn:endEvent>
    <bpmn:sequenceFlow id="critical_vulnerability_flow_1" sourceRef="critical_vulnerability_start" targetRef="critical_vulnerability_intake_1"></bpmn:sequenceFlow>
    <bpmn:sequenceFlow id="critical_vulnerability_flow_2" sourceRef="critical_vulnerability_intake_1" targetRef="critical_vulnerability_split"></bpmn:sequenceFlow>
    <bpmn:sequenceFlow id="critical_vulnerability_flow_3" sourceRef="critical_vulnerability_split" targetRef="critical_vulnerability_check_0_1"></bpmn:sequenceFlow>
    <bpmn:sequenceFlow id="critical_vulnerability_flow_4" sourceRef="critical_vulnerability_check_0_1" targetRef="critical_vulnerability_check_0_2"></bpmn:sequenceFlow>
    <bpmn:sequenceFlow id="critical_vulnerability_flow_5" sourceRef="critical_vulnerability_split" targetRef="critical_vulnerability_check_1_1"></bpmn:sequenceFlow>
    <bpmn:sequenceFlow id="critical_vulnerability_flow_6" sourceRef="critical_vulnerability_check_1_1" targetRef="critical_vulnerability_check_1_2"></bpmn:sequenceFlow>
    <bpmn:sequenceFlow id="critical_vulnerability_flow_7" sourceRef="critical_vulnerability_split" targetRef="critical_vulnerability_check_2_1"></bpmn:sequenceFlow>
    <bpmn:sequenceFlow id="critical_vulnerability_flow_8" sourceRef="critical_vulnerability_check_2_1" targetRef="critical_vulnerability_check_2_2"></bpmn:sequenceFlow>
    <bpmn:sequenceFlow id="critical_vulnerability_flow_9" sourceRef="critical_vulnerability_check_0_2" targetRef="critical_vulnerability_join"></bpmn:sequenceFlow>
    <bpmn:sequenceFlow id="critical_vulnerability_flow_10" sourceRef="critical_vulnerability_check_1_2" targetRef="critical_vulnerability_join"></bpmn:sequenceFlow>
    <bpmn:sequenceFlow id="critical_vulnerability_flow_11" sourceRef="critical_vulnerability_check_2_2" targetRef="critical_vulnerability_join"></bpmn:sequenceFlow>
    <bpmn:sequenceFlow id="critical_vulnerability_flow_12" sourceRef="critical_vulnerability_join" targetRef="critical_vulnerability_decision"></bpmn:sequenceFlow>
    <bpmn:sequenceFlow id="critical_vulnerability_flow_13" sourceRef="critical_vulnerability_decision" targetRef="critical_vulnerability_success_1" name="Yes"><bpmn:conditionExpression xsi:type="bpmn:tFormalExpression">=remediationVerified = true</bpmn:conditionExpression></bpmn:sequenceFlow>
    <bpmn:sequenceFlow id="critical_vulnerability_flow_14" sourceRef="critical_vulnerability_decision" targetRef="critical_vulnerability_exception_1" name="Otherwise"></bpmn:sequenceFlow>
    <bpmn:sequenceFlow id="critical_vulnerability_flow_15" sourceRef="critical_vulnerability_success_1" targetRef="critical_vulnerability_success_rest_1"></bpmn:sequenceFlow>
    <bpmn:sequenceFlow id="critical_vulnerability_flow_16" sourceRef="critical_vulnerability_exception_1" targetRef="critical_vulnerability_exception_rest_1"></bpmn:sequenceFlow>
    <bpmn:sequenceFlow id="critical_vulnerability_flow_17" sourceRef="critical_vulnerability_success_rest_1" targetRef="critical_vulnerability_complete"></bpmn:sequenceFlow>
    <bpmn:sequenceFlow id="critical_vulnerability_flow_18" sourceRef="critical_vulnerability_exception_rest_1" targetRef="critical_vulnerability_alternate"></bpmn:sequenceFlow>
  </bpmn:process>
  <bpmn:collaboration id="critical_vulnerability_collaboration"><bpmn:participant id="critical_vulnerability_party" name="Security operations"/><bpmn:participant id="critical_vulnerability_pool" name="Critical vulnerability remediation with independent verification" processRef="critical_vulnerability_process"/><bpmn:messageFlow id="critical_vulnerability_request" sourceRef="critical_vulnerability_party" targetRef="critical_vulnerability_start"/></bpmn:collaboration>
  <bpmndi:BPMNDiagram id="critical_vulnerability_diagram"><bpmndi:BPMNPlane id="critical_vulnerability_plane" bpmnElement="critical_vulnerability_collaboration">
    <bpmndi:BPMNShape id="critical_vulnerability_party_di" bpmnElement="critical_vulnerability_party" isHorizontal="true"><dc:Bounds x="20" y="20" width="2210" height="70"/></bpmndi:BPMNShape>
    <bpmndi:BPMNShape id="critical_vulnerability_pool_di" bpmnElement="critical_vulnerability_pool" isHorizontal="true"><dc:Bounds x="20" y="180" width="2210" height="780"/></bpmndi:BPMNShape>
    <bpmndi:BPMNShape id="critical_vulnerability_lane_0_di" bpmnElement="critical_vulnerability_lane_0" isHorizontal="true"><dc:Bounds x="50" y="180" width="2180" height="260"/></bpmndi:BPMNShape>
    <bpmndi:BPMNShape id="critical_vulnerability_lane_1_di" bpmnElement="critical_vulnerability_lane_1" isHorizontal="true"><dc:Bounds x="50" y="440" width="2180" height="260"/></bpmndi:BPMNShape>
    <bpmndi:BPMNShape id="critical_vulnerability_lane_2_di" bpmnElement="critical_vulnerability_lane_2" isHorizontal="true"><dc:Bounds x="50" y="700" width="2180" height="260"/></bpmndi:BPMNShape>
    <bpmndi:BPMNShape id="critical_vulnerability_start_di" bpmnElement="critical_vulnerability_start"><dc:Bounds x="162" y="292" width="36" height="36"/><bpmndi:BPMNLabel><dc:Bounds x="108" y="335" width="144" height="40"/></bpmndi:BPMNLabel></bpmndi:BPMNShape>
    <bpmndi:BPMNShape id="critical_vulnerability_intake_1_di" bpmnElement="critical_vulnerability_intake_1"><dc:Bounds x="325" y="272" width="130" height="76"/></bpmndi:BPMNShape>
    <bpmndi:BPMNShape id="critical_vulnerability_split_di" bpmnElement="critical_vulnerability_split"><dc:Bounds x="576" y="286" width="48" height="48"/></bpmndi:BPMNShape>
    <bpmndi:BPMNShape id="critical_vulnerability_check_0_1_di" bpmnElement="critical_vulnerability_check_0_1"><dc:Bounds x="745" y="272" width="130" height="76"/></bpmndi:BPMNShape>
    <bpmndi:BPMNShape id="critical_vulnerability_check_0_2_di" bpmnElement="critical_vulnerability_check_0_2"><dc:Bounds x="955" y="272" width="130" height="76"/></bpmndi:BPMNShape>
    <bpmndi:BPMNShape id="critical_vulnerability_check_1_1_di" bpmnElement="critical_vulnerability_check_1_1"><dc:Bounds x="745" y="532" width="130" height="76"/></bpmndi:BPMNShape>
    <bpmndi:BPMNShape id="critical_vulnerability_check_1_2_di" bpmnElement="critical_vulnerability_check_1_2"><dc:Bounds x="955" y="532" width="130" height="76"/></bpmndi:BPMNShape>
    <bpmndi:BPMNShape id="critical_vulnerability_check_2_1_di" bpmnElement="critical_vulnerability_check_2_1"><dc:Bounds x="745" y="792" width="130" height="76"/></bpmndi:BPMNShape>
    <bpmndi:BPMNShape id="critical_vulnerability_check_2_2_di" bpmnElement="critical_vulnerability_check_2_2"><dc:Bounds x="955" y="792" width="130" height="76"/></bpmndi:BPMNShape>
    <bpmndi:BPMNShape id="critical_vulnerability_join_di" bpmnElement="critical_vulnerability_join"><dc:Bounds x="1206" y="286" width="48" height="48"/></bpmndi:BPMNShape>
    <bpmndi:BPMNShape id="critical_vulnerability_decision_di" bpmnElement="critical_vulnerability_decision" isMarkerVisible="true"><dc:Bounds x="1416" y="286" width="48" height="48"/><bpmndi:BPMNLabel><dc:Bounds x="1368" y="236" width="144" height="40"/></bpmndi:BPMNLabel></bpmndi:BPMNShape>
    <bpmndi:BPMNShape id="critical_vulnerability_success_1_di" bpmnElement="critical_vulnerability_success_1"><dc:Bounds x="1585" y="272" width="130" height="76"/></bpmndi:BPMNShape>
    <bpmndi:BPMNShape id="critical_vulnerability_exception_1_di" bpmnElement="critical_vulnerability_exception_1"><dc:Bounds x="1585" y="792" width="130" height="76"/></bpmndi:BPMNShape>
    <bpmndi:BPMNShape id="critical_vulnerability_success_rest_1_di" bpmnElement="critical_vulnerability_success_rest_1"><dc:Bounds x="1795" y="272" width="130" height="76"/></bpmndi:BPMNShape>
    <bpmndi:BPMNShape id="critical_vulnerability_exception_rest_1_di" bpmnElement="critical_vulnerability_exception_rest_1"><dc:Bounds x="1795" y="792" width="130" height="76"/></bpmndi:BPMNShape>
    <bpmndi:BPMNShape id="critical_vulnerability_complete_di" bpmnElement="critical_vulnerability_complete"><dc:Bounds x="2052" y="292" width="36" height="36"/><bpmndi:BPMNLabel><dc:Bounds x="1998" y="335" width="144" height="40"/></bpmndi:BPMNLabel></bpmndi:BPMNShape>
    <bpmndi:BPMNShape id="critical_vulnerability_alternate_di" bpmnElement="critical_vulnerability_alternate"><dc:Bounds x="2052" y="812" width="36" height="36"/><bpmndi:BPMNLabel><dc:Bounds x="1998" y="855" width="144" height="40"/></bpmndi:BPMNLabel></bpmndi:BPMNShape>
    <bpmndi:BPMNEdge id="critical_vulnerability_flow_1_di" bpmnElement="critical_vulnerability_flow_1"><di:waypoint x="198" y="310"/><di:waypoint x="325" y="310"/></bpmndi:BPMNEdge>
    <bpmndi:BPMNEdge id="critical_vulnerability_flow_2_di" bpmnElement="critical_vulnerability_flow_2"><di:waypoint x="455" y="310"/><di:waypoint x="576" y="310"/></bpmndi:BPMNEdge>
    <bpmndi:BPMNEdge id="critical_vulnerability_flow_3_di" bpmnElement="critical_vulnerability_flow_3"><di:waypoint x="624" y="310"/><di:waypoint x="745" y="310"/></bpmndi:BPMNEdge>
    <bpmndi:BPMNEdge id="critical_vulnerability_flow_4_di" bpmnElement="critical_vulnerability_flow_4"><di:waypoint x="875" y="310"/><di:waypoint x="955" y="310"/></bpmndi:BPMNEdge>
    <bpmndi:BPMNEdge id="critical_vulnerability_flow_5_di" bpmnElement="critical_vulnerability_flow_5"><di:waypoint x="624" y="310"/><di:waypoint x="685" y="310"/><di:waypoint x="685" y="570"/><di:waypoint x="745" y="570"/></bpmndi:BPMNEdge>
    <bpmndi:BPMNEdge id="critical_vulnerability_flow_6_di" bpmnElement="critical_vulnerability_flow_6"><di:waypoint x="875" y="570"/><di:waypoint x="955" y="570"/></bpmndi:BPMNEdge>
    <bpmndi:BPMNEdge id="critical_vulnerability_flow_7_di" bpmnElement="critical_vulnerability_flow_7"><di:waypoint x="624" y="310"/><di:waypoint x="685" y="310"/><di:waypoint x="685" y="830"/><di:waypoint x="745" y="830"/></bpmndi:BPMNEdge>
    <bpmndi:BPMNEdge id="critical_vulnerability_flow_8_di" bpmnElement="critical_vulnerability_flow_8"><di:waypoint x="875" y="830"/><di:waypoint x="955" y="830"/></bpmndi:BPMNEdge>
    <bpmndi:BPMNEdge id="critical_vulnerability_flow_9_di" bpmnElement="critical_vulnerability_flow_9"><di:waypoint x="1085" y="310"/><di:waypoint x="1206" y="310"/></bpmndi:BPMNEdge>
    <bpmndi:BPMNEdge id="critical_vulnerability_flow_10_di" bpmnElement="critical_vulnerability_flow_10"><di:waypoint x="1085" y="570"/><di:waypoint x="1146" y="570"/><di:waypoint x="1146" y="310"/><di:waypoint x="1206" y="310"/></bpmndi:BPMNEdge>
    <bpmndi:BPMNEdge id="critical_vulnerability_flow_11_di" bpmnElement="critical_vulnerability_flow_11"><di:waypoint x="1085" y="830"/><di:waypoint x="1146" y="830"/><di:waypoint x="1146" y="310"/><di:waypoint x="1206" y="310"/></bpmndi:BPMNEdge>
    <bpmndi:BPMNEdge id="critical_vulnerability_flow_12_di" bpmnElement="critical_vulnerability_flow_12"><di:waypoint x="1254" y="310"/><di:waypoint x="1416" y="310"/></bpmndi:BPMNEdge>
    <bpmndi:BPMNEdge id="critical_vulnerability_flow_13_di" bpmnElement="critical_vulnerability_flow_13"><di:waypoint x="1464" y="310"/><di:waypoint x="1585" y="310"/><bpmndi:BPMNLabel><dc:Bounds x="1472" y="283" width="100" height="22"/></bpmndi:BPMNLabel></bpmndi:BPMNEdge>
    <bpmndi:BPMNEdge id="critical_vulnerability_flow_14_di" bpmnElement="critical_vulnerability_flow_14"><di:waypoint x="1464" y="310"/><di:waypoint x="1525" y="310"/><di:waypoint x="1525" y="830"/><di:waypoint x="1585" y="830"/><bpmndi:BPMNLabel><dc:Bounds x="1472" y="320" width="100" height="22"/></bpmndi:BPMNLabel></bpmndi:BPMNEdge>
    <bpmndi:BPMNEdge id="critical_vulnerability_flow_15_di" bpmnElement="critical_vulnerability_flow_15"><di:waypoint x="1715" y="310"/><di:waypoint x="1795" y="310"/></bpmndi:BPMNEdge>
    <bpmndi:BPMNEdge id="critical_vulnerability_flow_16_di" bpmnElement="critical_vulnerability_flow_16"><di:waypoint x="1715" y="830"/><di:waypoint x="1795" y="830"/></bpmndi:BPMNEdge>
    <bpmndi:BPMNEdge id="critical_vulnerability_flow_17_di" bpmnElement="critical_vulnerability_flow_17"><di:waypoint x="1925" y="310"/><di:waypoint x="2052" y="310"/></bpmndi:BPMNEdge>
    <bpmndi:BPMNEdge id="critical_vulnerability_flow_18_di" bpmnElement="critical_vulnerability_flow_18"><di:waypoint x="1925" y="830"/><di:waypoint x="2052" y="830"/></bpmndi:BPMNEdge>
    <bpmndi:BPMNEdge id="critical_vulnerability_request_di" bpmnElement="critical_vulnerability_request"><di:waypoint x="180" y="90"/><di:waypoint x="180" y="292"/></bpmndi:BPMNEdge>
    
  </bpmndi:BPMNPlane></bpmndi:BPMNDiagram>
</bpmn:definitions>