What it asks for. Organisations should continuously assess and track vulnerabilities across their assets and remediate them to shrink the window attackers can exploit. This requires a documented process, regular scanning and risk based remediation.
In practice. A strong process combines authenticated scanning of internal and external assets, patch management for operating systems and applications, and prioritisation using severity, exploitability and asset criticality, for example by giving known exploited vulnerabilities top priority. Remediation targets are defined by risk level and tracked, and exceptions are approved and time limited. Auditors look for scan coverage, remediation metrics against targets, patch reports and the exception register.
Common gaps. Scanning coverage is often incomplete, missing cloud, containers and network appliances, and unauthenticated scans give a false sense of security. Many organisations measure findings but not time to remediate, so old critical vulnerabilities persist.