A Vulnerability Governance Architecture for Power and Utilities Corporations: From Exposure Mapping to Remediation Verification

Vulnerability management in power and utilities corporations is constrained by the long lifecycles of operational technology assets, the limited availability of vendor patches, regulatory expectations for documented remediation, and the practical impossibility of taking many control system components offline for maintenance on demand. This paper presents a governance architecture that organizes vulnerability handling from initial exposure mapping through to verified remediation across both information technology and operational technology environments. The architecture is structured around six interlocking domains. Asset and exposure inventory establish the canonical map of cyber assets and the vulnerabilities affecting them. Risk scoring and prioritization combines the Common Vulnerability Scoring System, the Exploit Prediction Scoring System, asset criticality, compensating controls, and operational impact considerations to produce a defensible action queue. Remediation orchestration coordinates patching, configuration hardening, virtual patching at the network layer, and procedural compensations. Verification confirms that intended changes took effect without unintended consequences. Reporting communicates posture to executive and regulatory audiences. Continuous improvement closes the loop through metrics and after-action reviews. The architecture aligns with the North American Electric Reliability Corporation Critical Infrastructure Protection standards on configuration change management and vulnerability assessment, with the National Institute of Standards and Technology Special Publication 800 40 on patching, and with the Department of Energy cybersecurity capability maturity model. The paper presents three illustrative scenarios spanning routine patching of corporate endpoints, emergency response to an exploited industrial control system vulnerability, and structured deferral of a low risk operational technology vulnerability with documented compensating controls. The proposed governance architecture supports both compliance reporting and substantive risk reduction.