When an auditor asks how your team handles vulnerabilities, “we scan regularly” won’t get you very far. Auditors want to see how quickly you fix, who approved leaving something unfixed, and a record of both. This 101 training shows you where that evidence lives in DefectDojo and how to pull it together to meet compliance guidelines.

The session covers both Community Edition and Pro features, including SLA performance tracking on the Executive Insights and Remediation Metrics dashboards and single Risk Acceptances that apply across several applications at once.

By the end of this session, you’ll be able to:

• Set up an SLA configuration that assigns remediation deadlines by severity, and turn on notifications when findings breach them
• Filter findings to pull a list of everything that has run past its SLA
• Create a Full Risk Acceptance with an owner, supporting documentation, and an expiration date, and explain what happens to the accepted findings when it expires
• Build a custom report in the Report Builder and export it as a PDF for an auditor
• Identify what DefectDojo Pro adds for compliance work, including risk-based SLAs, SLA tracking on the Executive Insights and Remediation Metrics dashboards, and Risk Acceptances that span several applications