---
sourceDocument: Brazil Security Management
sourceDocumentLink: https://www.servicenow.com/docs/r/security-management

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Vulnerability Response remediation target rules

# Vulnerability Response remediation target rules {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 5 minutes to read
Summarize  
![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI  
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.  

## Summary of Vulnerability Response remediation target rules

Remediation target rules in ServiceNow Vulnerability Response define specific time frames for remediating vulnerable items (VIs), similar to SLAs but focused at the item level.
These rules help ensure compliance with standards like PCI DSS by setting deadlines to fix vulnerabilities based on asset data and risk ratings.
Vulnerability managers create and manage these rules by specifying remediation targets, reminder targets, notification recipients, and how the system recalculates due dates when risk ratings change.
Show full answer Show less  

## Key Features

* **Remediation Target Dates:** Displayed on VI forms and lists, color-coded as green (not due), orange (approaching due), or red (past due).
* **Notifications:** Summary emails notify recipients when VIs approach or pass remediation targets.
* **Recalculation Methods:** Administrators can configure how remediation target dates update when a VI's risk rating changes, with options to use default calculations or adjust based on risk change timing and severity.
* **Multiple Rules Handling:** When multiple rules apply to a VI, the system enforces the most restrictive (earliest) remediation target date.
* **Scheduled Job:** The Evaluate remediation targets job runs daily to apply and update remediation targets on active VIs and trigger notifications accordingly.
* **Rule Management:** Rules can be deactivated or deleted, with effects on existing VIs' remediation target dates. Changes to rules can be reapplied to open VIs using an Apply Changes function.
* **Workspace Efficiency:** Vulnerability Manager Workspace offers a faster way for admins and analysts to get updated remediation target dates for selected VIs without recalculating all records.

## Practical Application for ServiceNow Customers

By configuring remediation target rules, customers can enforce timely remediation aligned with organizational policies and compliance requirements. The color-coded status indicators and notifications help vulnerability teams prioritize work and track progress. The recalculation methods provide flexibility to adapt remediation schedules dynamically as risks change, ensuring focus on the highest-risk items. Scheduled jobs automate maintenance of remediation targets, reducing manual oversight.

When updating or creating remediation target rules, customers should reapply changes to ensure all relevant VIs reflect the latest requirements. Leveraging the Vulnerability Manager Workspace can improve efficiency in managing remediation targets, especially in environments with large volumes of vulnerabilities.  
Remediation target rules define the expected time frame for remediating vulnerable items (VI), much like SLAs provide a time frame for remediating the vulnerability itself. For example, if an asset contains PCI data (credit card data) then the vulnerability on that item must be fixed within 30 days according to PCI DSS.{#time-to-remediate-rules__kp6}  
Vulnerability managers can create remediation target rules by defining:

* The remediation target
* The reminder target
* The reminder and notification recipients: Who should be notified when the vulnerable items (VIs) are past the reminder or remediation target date and haven't been remediated.
* The recalculation method: How the system updates the remediation target (RT) date when a vulnerable item's risk rating changes.
{#time-to-remediate-rules__ul_wgc_nyw_xdb}

Vulnerability analysts and managers can see the remediation target date in the vulnerability item form and list views, as long as the vulnerable items aren't in Deferred, Resolved, or Closed state. Remediation target rules are run on import and rerun if a VI is reopened.  
The Remediation target date is color-coded on the VI list view as dots, as follows:

* Vulnerable items that haven't reached their notification date are shown in green.
* Vulnerable items approaching the remediation target date are shown in orange.
* Vulnerable items past the remediation target date are shown in red.
{#time-to-remediate-rules__ul_qfv_nht_fdb}

A summary email, per remediation target rule, is sent when one or more VIs are either
approaching their remediation target date or the remediation target date has passed.

## Recalculation of remediation target date {#time-to-remediate-rules__section_gwh_prm_ghc}

Starting with Unified Security Exposure Management version 30.0.4 and Vulnerability Response version 26.4.4, administrators can configure how the system recalculates the remediation target date when a finding's risk rating
changes.

* Under normal conditions, the system calculates the RT date as:Remediation Target = Target from (date) + Target (days)

* When the risk rating changes, the system calculates a new RT date using the formula below. The selected recalculation method determines whether this new date replaces the existing RT date.Recalculated RT date = Field change time + Target (days)

  Field change time captures when the risk rating changed. Target (days) uses SLA of new risk
  rating.

{#time-to-remediate-rules__ul_ypp_51s_3hc}  
The following options define how the system applies the recalculated RT date when a risk rating changes:{#time-to-remediate-rules__table_ogs_hbs_3hc__entry__2}

| Recalculation method | Description |
|-|-|
| Default calculation | Recalculates the RT date using the standard formula (Target from (date) + Target (days)), based on the rule that currently matches the finding's risk rating. The Field change time-based recalculated date is not applied. |
| Recalculate from risk change date | Updates the Remediation Target date to: Field change time + Target (days) based on the new risk rating. |
| Recalculate from risk change date and always set to earliest target date | Compares the existing RT date with Field change time + Target (days) and applies the earlier date. |
| Recalculate from risk change date and set to earliest target date only when risk rating increases | If the risk increases: Compares the existing RT date and the recalculated RT date and applies the earliest date. If the risk decreases: Compares the existing RT date and the recalculated RT date and applies whichever date is later. |
[ ]

{#time-to-remediate-rules__table_ogs_hbs_3hc}

For configuration steps, see [Recalculate a remediation target date](https://www.servicenow.com/docs/Kf0BDMjIZNtAMB7F7ALfcg "The remediation target (RT) date defines when a finding must be remediated. Recalculation verifies that RT dates stay accurate and reflect the latest risk rating updates. When a finding’s risk rating changes, the system can recalculate RT dates using the most recent update date, helping maintain accurate SLAs and avoid outdated or overdue target dates.").

## Remediation target rules can be deactivated or deleted {#time-to-remediate-rules__section_a1q_w1x_wmb}

When a rule is deactivated, the current remediation target dates for the VIs it was applied
to are cleared. If a VI satisfies any active rule that rule is applied, otherwise the VI has
no rule or target date, and its status is No Target.

When rules are deleted, the Remediation target date and related fields on closed, deferred, or resolved VIs are preserved. The Remediation target date and related fields on
non-closed VIs are cleared and any dependent rules are reapplied.

## Remediation target rule scenario {#time-to-remediate-rules__section_v1r_4hh_wmb}

When multiple remediation target rules are applied to the same vulnerable item, the most restrictive rule is applied.  
Note:  
Remediation targets are calculated from the Last Opened date plus the number of days (measured as 24-hour increments).

Starting from
V17.1, remediation targets are calculated from the Target from (date). The default value remains Last opened date.

For example, if a vulnerable item meets the
condition for two remediation target rules:  
Scenario: Vulnerable item last opened on 03/01/2018 at 10:00:00.

* Remediation target rule 1: Last opened on 03/07/2018; remediation target is 15 days since it was last opened; calculated remediation target date is 03/16/2018 10:00:00.
* Remediation target rule 2: Last opened on 03/10/2018; remediation target is 10 days since it was last opened; calculated remediation target date is 03/11/2018 10:00:00.
{#time-to-remediate-rules__ul_lrb_2zw_xdb}  
In this scenario, the Remediation target rule 2 applies to the vulnerable item since it has the more restrictive date. 10 days since the vulnerable item was first identified versus 15 days.  
Note:  
Once the Remediation target rule is defined, remediation target dates are calculated by the Evaluate remediation targets scheduled job.

## About the Evaluate remediation targets scheduled job {#time-to-remediate-rules__section_tk5_thh_wmb}

Evaluate remediation targets runs once at 4:00:00 daily.  
It iterates through all active vulnerability rules, starting with those rules with the earliest remediation target date. It looks at all vulnerable items that:

* Aren't in a Closed, Deferred, or Resolved state.
* Have no remediation target date.
* Have a remediation target date that is later than the date in the remediation target rule.
{#time-to-remediate-rules__ul_rbr_w2p_2fb}

Evaluate remediation targets adds a remediation target date, if one doesn't exist, or if a rule results in an earlier date than the one in the record, it updates the existing target date. Finally, it updates
the Remediation target and Remediation status fields in the vulnerable item form.

Once the Evaluate remediation targets runs, available notifications are sent.

Evaluate remediation targets clears the remediation fields on the VI and stops sending notifications.

The sn_sec_cmn.evaluate_targetmissed_records property, when enabled, prevents the Remediation Target Rules scheduled job from evaluating missed VIs. This property is enabled by
default.

## Reapplying remediation target rules {#time-to-remediate-rules__section_nxb_xnp_s3b}

When you change a remediation target rule, use the Apply Changes button on the Remediation Target Rules list page to rerun all the changed rules on all active Open VIs except those in the Closed, Deferred or Resolved state. Depending on how many VIs you have, this may take time.  
Note:  
If the scheduled job, Evaluate remediation targets is running, you can't initiate a reapply process. However, if a reapply process is already running, and the scheduled job it triggered, they run in
parallel.

The reapply processes in Vulnerability Response and Application Vulnerability Response are independent and can run in parallel.  
Important:  
As a vulnerability admin and analyst, you can obtain the latest remediation target date for selected vulnerable items in the Vulnerability Manager Workspace. This method is more efficient than running the Remediation Target Rules for all vulnerable items in the classic UI, which is a time-consuming process. For more information, see [Re-evaluate the remediation properties of the records in the Vulnerability Manager Workspace](https://www.servicenow.com/docs/f4Ar199GsH7eAZCRZSPnQA "Evaluate the assignments, remediation target date, remediation tasks, exceptions, and risk score for a set of records (VITs, AVITs, CVITs or TRs) in the Vulnerability Manager Workspace.").
**Related tasks**   

* [Create or edit a Vulnerability Response remediation target rule](https://www.servicenow.com/docs/QMwHrW3o1FyFnbE2KMDSeA "Set up remediation target rules after completing your initial assessment in the Setup Assistant. Vulnerability managers can set up a remediation target rule at the vulnerable item level to drive the remediation of high-risk vulnerabilities in a timely manner. When the remediation date for a vulnerable item is approaching, the system sends a notification to the users or groups specified in the rule.")
* [View the remediation target status of a Vulnerability Response vulnerable item](https://www.servicenow.com/docs/HUJqU6Xia_tVy2XBRhnXFg "When a vulnerable item has nearly reached (or passed) its remediation target date, as defined by a remediation target rule, the vulnerable item record is updated with a status. This information can help the analyst proactively monitor upcoming remediation activities.")
* [Create or edit remediation target notifications](https://www.servicenow.com/docs/AmOqXIHj5_E281x6xoZINg "Vulnerability administrators can edit the remediation target notification or add new ones, specifying when to send the notification, who receives the notification, and what content is in the notification.")