# Vulnerability response timeline and exposure record

Blank work product. Replace bracketed fields with system-specific facts. Unknown evidence stays unknown; do not mark a control passed because a template is complete.

## Advisory and deployment join

- Incident ID / coordinator / product owner: [names]
- Primary advisory, revision date, affected/fixed range and preconditions: [source]
- Component identifier / artifact digest / running instances: [evidence]
- Observed exploitation, possible exposure and unknowns: [separate statements]

## Timeline

| UTC time | Observation or action | Evidence source | Confidence | Actor / owner | Next decision |
| --- | --- | --- | --- | --- | --- |
| [time] | [fact] | [immutable record] | [known/assumed/unknown] | [owner] | [action] |

## Exposure and containment

| Deployment / artifact | Component present | Vulnerable path / config | Exposure | Containment | Verification |
| --- | --- | --- | --- | --- | --- |
| [target] | [proof] | [proof or unknown] | [reachable by whom] | [action] | [actual result] |

## Recovery and follow-up

Document evidence preservation, authorized communications, patch/rollback procedure, running-artifact verification, credential response if indicated, removal of temporary controls, customer-impact assessment and prevention work. Do not infer no compromise from absent logs.