Ensure all Jenkins jobs are working for the VFC repositories that are part of Kohn release, 

Update the vulnerable direct dependencies in their code base following the recommendations of SECCOM documented in https://wiki.onap.org/display/SV/Kohn+VFC.

Identify resource or technical constraints to SECCOM by (M2).

Submit a LF Ticket for access to the Security Vulnerabilities space (if needed).

Execute packages upgrades accordingly.

Update statuses in https://wiki.onap.org/display/SV/Kohn+VFC.

For the agreed resource or technical constraints provide waiver status with declaration on when it is planned to be solved.