Implement critical security patches within prescribed timelines, remediate vulnerabilities through configuring the software (e.g., turning off or limiting access to ports or services), or obtain and document the open vulnerabilities in a Plan of Action and Milestones.