---
title: Implementation checklist for the Vulnerability Response application
description: This checklist lists the steps required for a basic implementation of the Vulnerability Response application on your ServiceNow AI Platform instance. When you have completed these tasks, the base system is ready for operation and verification.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/security-management/vulnerability-response/vr-implement-chklist.html
release: australia
product: Vulnerability Response
classification: vulnerability-response
topic_type: task
last_updated: "2026-03-12"
reading_time_minutes: 9
breadcrumb: [Vulnerability Response reference information, Vulnerability Response, Unified Security Exposure Management, Security Operations]
---

# Implementation checklist for the Vulnerability Response application

This checklist lists the steps required for a basic implementation of the Vulnerability Response application on your ServiceNow AI Platform® instance. When you have completed these tasks, the base system is ready for operation and verification.

## Before you begin

Roles required: admin for downloading and activating applications and assigning roles, sn\_vul.vulnerability\_admin for configuring Vulnerability Response.

## Procedure

1.  Consider creating and printing a PDF of this checklist so that you can check off tasks as you complete them.

2.  To generate a PDF, click the **Save As PDF** icon \(\[Omitted image "vr-pdf-download.png"\] Alt text: Save as PDF icon\) at the top of the topic and click Selected topic.

<table id="table_tvq_qvw_nhb"><thead><tr><th>

Item

</th><th>

Description

</th></tr></thead><tbody><tr><td>

\[Omitted image "checkbox.png"\] Alt text: Checkbox

</td><td>

As a user with the admin role, verify that you have the obtained any entitlements and downloaded \(**Install**\) the following applications from the ServiceNow® Store onto your ServiceNow AI Platform instance:-   Vulnerability Response
-   Vulnerability Response Integration with the NIST National Vulnerability Database
-   Qualys Integration for Security Operations
 1.  To verify the applications are available on your instance, navigate to **All** &gt; **System Applications** &gt; **All Available Applications** &gt; **All** and search for \[sn\_vul\], \[sn\_vul\_nvd\], and \[sn\_vul\_qualys\].
2.  If you can't locate the applications, see [Security Operations and the ServiceNow Store](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/secops-and-store.md) for more information about getting entitlement and downloading the applications.


</td></tr><tr><td>

\[Omitted image "checkbox.png"\] Alt text: Checkbox

</td><td>

As a user with the admin role, navigate **All** &gt; **Vulnerability Response** &gt; **Administration** &gt; **Setup Assistant** &gt; **Integration Application Installation** and activate \(**Install**\) the Vulnerability Response application along with its dependencies on your ServiceNow AI Platform instance. **Note:** During installation of the Vulnerability Response application, you have the option to install demo data.

Demo data is required if you want to run automated tests to confirm that your instance works after installation. Run tests only on development, test, and other non-production instances to avoid data corruption and outage. If demo data or demo accounts are created, all demo data should be removed prior to using the instance in non-production or production.

The Setup Assistant for Vulnerability Response is installed automatically along with the application. The Setup Assistant is required to configure the Vulnerability Response application. Additionally, it is used to install and configure the Qualys Integration for Security Operations application used in this example, as well as other applications that support and are compatible with Vulnerability Response.

 For more information about installing the Vulnerability Response application, see [Install Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-response/install-and-configure-vr.md).

</td></tr><tr><td>

\[Omitted image "checkbox.png"\] Alt text: Checkbox

</td><td>

As a user with the admin role, in Setup Assistant, navigate to **All** &gt; **Vulnerability Response Users and Groups** and assign users with the required Vulnerability Response persona roles. 1.  From within Setup Assistant, view existing users and any roles that are already assigned by clicking the **User Administration module** link.
2.  From the list, click a user name to open the record and click the **Roles** related list. All the roles assigned to this user are displayed.
3.  Navigate back to **Vulnerability Response Users and Groups** in Setup Assistant and follow the prompts to assign the sn\_vul.vulnerability\_admin role.
 **Note:** The sn\_vul.vulnerability\_admin role is required to continue with the configuration. Alternatively, you can continue with the configuration as a user with the admin role.

\(Optional\) You can also assign the Configuration Item \(CI\) Manager \[sn\_vul.ci\_manager\] and Exception Approver \[sn\_vul.exception\_approver\] roles, but these personas are not required for the remaining setup tasks.

 For more information about assigning the persona roles using the Setup Assistant, see [Assign the Vulnerability Response persona roles using Setup Assistant](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-response/vr-assign-personas_SA.md).

 For more information on users and assigning roles to users and groups, see [User administration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-administration/c_UserAdministration.md).

</td></tr><tr><td>

\[Omitted image "checkbox.png"\] Alt text: Checkbox

</td><td>

1.  Navigate to **All** &gt; **Administration** &gt; **Integrations** and verify the **CWE Comprehensive 2000 Integration** is activated and run the scheduled job to import data.
2.  As a user with the admin role, navigate to **System Applications** &gt; **All Available Applications** and activate \(**Install**\) the Vulnerability Response Integration with NVD application.
 Run the NVD and CWE integrations as part of your initial setup of Vulnerability Response and prior to importing vulnerability data into your instance with a third-party scanner product.

 See [Importing data with the NVD and CWE integrations and managing third-party libraries](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-response/c_NVDAndCWEDataImport.md) and [Configure and run the scheduled job for updating CWE records](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-response/t_ConfigureScheduledJobsCWE.md) for more information about installing, configuring, and viewing the NVD and CWE libraries.

</td></tr><tr><td>

\[Omitted image "checkbox.png"\] Alt text: Checkbox

</td><td>

As a user with the admin role, navigate **All** &gt; **Vulnerability Response** &gt; **Administration** &gt; **Setup Assistant** &gt; **Integration Application Installation** and activate the Qualys Integration for Security Operations application. Before you install and run a third-party scanner product like Qualys that has a library, you must first install and run the NVD and CWE Integrations to ingest vulnerability data. For more information, see [Install Vulnerability Response third-party applications using Setup Assistant](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-response/vr-installapp-setup-asst.md).

</td></tr><tr><td>

\[Omitted image "checkbox.png"\] Alt text: Checkbox

</td><td>

\(Optional\) As a user with the admin role, if you installed demo data with the Vulnerability Response application, you can run the Vulnerability Response ATF Test Suite to verify the applications successfully installed.**Note:** Run tests only on development, test, and other non-production instances to avoid data corruption and outage.

 For more information, see [Run the Automated Test Framework \(ATF\) test suite for Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-response/vr-run-vr-atf-suite.md).

 For more information about automated tests, see [Automated Test Framework \(ATF\)](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/application-development/automated-test-framework.md).

</td></tr></tbody>
</table>3.  Continue with the configuration of the applications starting in the Vulnerability Response Settings section.

    Reviewing these settings helps you understand how Vulnerability Response works as you continue to set up your environment. For the scanner integration used in this example, you are required to edit the settings.

    The concepts you use in this configuration example for the Qualys product apply to other scanner applications.

    Your Qualys credentials are required to configure the application. Verify you have any account names, passwords, and other service information required by Qualys products so that you have access to them.

    Roles required: sn\_vul.vulnerability\_admin or, alternatively, admin.

<table id="table_qby_jng_tlb"><thead><tr><th>

Task

</th><th>

Description

</th></tr></thead><tbody><tr><td>

\[Omitted image "checkbox.png"\] Alt text: Checkbox

</td><td>

Review the Vulnerability Assignment Rules.Assignment rules automatically assign vulnerable items \(VIs\) to the appropriate assignment group. For more information, see, .

 For more information about configuring Vulnerability Response using the Setup Assistant, see [Configuring Vulnerability Response using the Setup Assistant](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-response/cj-setup-assistant.md).

</td></tr><tr><td>

\[Omitted image "checkbox.png"\] Alt text: Checkbox

</td><td>

Review the remediation task rules.

 Remediation task rules automatically group vulnerable items \(VIs\) as they are imported based on certain conditions. For more information, see [Vulnerability Response remediation tasks and remediation task rules overview](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-response/vulnerability-groups.md).

</td></tr><tr><td>

\[Omitted image "checkbox.png"\] Alt text: Checkbox

</td><td>

Review the Risk Calculators.

 Risk calculators score vulnerable items for prioritization. You can configure calculators to incorporate characteristics of the configuration item \(CI\), exploit availability, and vulnerability severity reported by your vulnerability assessment \(scanner\) vendor. For more information, see [Vulnerability Response calculators and vulnerability calculator rules](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-response/vuln-calculators-rules.md).

</td></tr><tr><td>

\[Omitted image "checkbox.png"\] Alt text: Checkbox

</td><td>

Review the Remediation Target Rules.

 Remediation Target Rules define remediation time lines for VIs and remediation tasks. For more information, see [Vulnerability Response remediation target rules](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-response/time-to-remediate-rules.md).

</td></tr><tr><td>

\[Omitted image "checkbox.png"\] Alt text: Checkbox

</td><td>

In the Integration Configuration section, review the Qualys application settings and define and schedule your data imports.

 1.  Click **Scanner Integrations**.
2.  On the Installed Applications page, click **Edit**.
3.  Enter your credentials and click **Next**.
4.  Read the descriptions for the KnowledgeBase Configuration.
5.  Review the Host Detection Configuration page for Import Settings, CI Lookup Rules, and Import Schedules.
6.  After you are satisfied with the settings on this page, click **Execute Now** to import data. Click the **View details** link that is displayed to view vulnerability integration run status.
7.  \(Optional\) Continue to edit configuration settings.
8.  Click **Finish** to complete the installation and configuration in Setup Assistant.
 For more information about configuring the Qualys application, see [Configure the Qualys Vulnerability Integration using Setup Assistant](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-response/qualys-config-in-SA.md).

</td></tr></tbody>
</table>
## What to do next

Congratulations! You successfully installed the Vulnerability Response application and configured it and a scanner application using the Setup Assistant. The base system is now ready for operation.

To download, install, and configure other applications for Vulnerability Response, follow the same steps and concepts you completed for the preceding checklist. Refer to specific topics provided for each application for more information.

For more information about supported applications available that are available to you from the ServiceNow Store for Vulnerability Response, see [Installation of Vulnerability Response and supported applications](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-response/cj-vr-setup.md).

For more information about how to use Vulnerability Response, see [Exploring the Vulnerability Response application](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-response/c_VulnerabilityResponse.md).