--- title: Operational Technology Vulnerability Solution Management description: Starting from the Xanadu version, Operational Technology \(OT\) Vulnerability Solution Management is a feature available within the Operational Technology Vulnerability Response application. locale: en-US canonical_url: https://www.servicenow.com/docs/r/australia/operational-technology/operational-technology-vulnerability-response/ot-vulnerability-solution-management.html release: australia product: Operational Technology Vulnerability Response classification: operational-technology-vulnerability-response topic_type: concept last_updated: "2026-03-12" reading_time_minutes: 3 breadcrumb: [Explore, Operational Technology Vulnerability Response, Operational Technology] --- # Operational Technology Vulnerability Solution Management Starting from the Xanadu version, Operational Technology \(OT\) Vulnerability Solution Management is a feature available within the Operational Technology Vulnerability Response application. Security and IT teams often spend a significant amount of time and effort to research vulnerability findings and identify the most effective solutions for their environment. In large organizations, translating vulnerability findings into remediation tasks is a manual, tedious, and error-prone process due to the volume and complexity of the vulnerabilities. OT Vulnerability Solution Management automatically correlates the vulnerability findings in your environment with possible solutions that remediate them. You can identify the remediation actions that apply to your vulnerabilities and prioritize them by the severity of the vulnerability risk. Also, you can mitigate the risk posed by vulnerabilities that cannot be patched immediately by using compensating controls for OT. For more information, see [Use compensating controls for Operational Technology](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/operational-technology/operational-technology-vulnerability-response/compensating-controls-for-ot.md). The OT Vulnerability Solution Management feature is based on the feature available in the Vulnerability Response application. For more information on Vulnerability Solution management, refer to [Vulnerability Solution Management](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vuln-solution-mgmt.md). OT Vulnerability Solution Management supports the generic format for solution intelligence integration. The generic framework for solution intelligence integration ingests data in different file formats from solution vendors. These formats speed up information exchange and processing. It also improves critical security-related information sharing in a standardized reporting format. The supported file format is the Common Security Advisory Framework \(CSAF\), which is an open-source standard that provides JSON-based structured, machine-readable security advisories. Major vendors such as Cybersecurity & Infrastructure Security Agency \(CISA\), Siemens, Hitachi, Schneider Electric, and others support the CSAF format. The CSAF supported solution management includes the following key features: - Configuration through Setup Assistant. For more information, see [Configure vulnerability solution providers](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configure-vulnerability-solution-providers.md). - Support of importing CSAF data through file import. For more information, see [Import Common Security Advisory Framework data through file import](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/import-csaf-file.md). - Support of importing CSAF data through CSAF URL. For more information, see [Import Common Security Advisory Framework \(CSAF\) data through CSAF URL](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/import-csaf-url.md). OT Vulnerability Solution Management enables you to import CSAF data from: - Individual vendors that support CSAF format and have a CSAF URL ROLIE Feed. You can use the CSAF URL ROLIE Feed provided by the vendor to import the CSAF data. For example, the Siemens URL ROLIE Feed. - CSAF Aggregators or Trusted Providers through a URL import that supports the ROLIE Feed. You can import CSAF data of multiple vendors from a Trusted Provider. For example, CISA is a Trusted Provider and you can import CSAF data of multiple vendors from the Industrial Control System \(ICS\) CSAF advisories located at the [CISA’s GitHub CSAF repository](https://github.com/cisagov/CSAF). These vulnerability solutions are automatically mapped to the correct vendor and vulnerable items \(VITs\) based on the Common Vulnerabilities and Exposures \(CVEs\). Using a Trusted Provider reduces the time and effort required to import CSAF data from individual vendors' CSAF URLs. - Support of importing CSAF data through advisories or using the APIs. For more information, see [Import Common Security Advisory Framework data from advisories](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/import-solution-advisories-csaf.md). **Note:** Navigate to **All** > **Vulnerability Response** > **Solutions** > **All** to view the list of solutions you have imported using the preceding methods. The Vulnerability Response plugin takes care of updating the metrics statuses of the created solution. **Parent Topic:**[Exploring Operational Technology Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/operational-technology/operational-technology-vulnerability-response/exploring-oper-tech-vulnerability-response.md) **Related topics** [View vulnerable items and solutions in the Industrial Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/operational-technology/operational-technology-vulnerability-response/view-solutions-of-vit-in-industrial-workspace.md)