A Practice Note providing an overview of what cyber vulnerability management programs are, how they work, and the key role they play in any organization's information security program. This Note discusses common types of cyber vulnerabilities and core process steps for implementing and maintaining a vulnerability management program, including patch management, to decrease cybersecurity risks. It also addresses common pitfalls that can lead to unnecessary cyber incidents and data breaches.