Remediation Tracking and Compliance
This domain tests how findings move from report to verified closure and how they map to compliance obligations.
Tracking
Assign each finding an owner, severity, SLA, and ticket. Define severity using exploitability and business impact, not CVSS alone. Critical internet-facing issues generally have shorter SLAs than low-risk internal observations. Track aging, mean time to remediate, closure rate, and reopened findings. Record risk acceptance with a named approver, justification, compensating controls, and expiry date.
Verification and compliance
Retest before closing. A ticket marked fixed is not evidence; a retest showing the vulnerable condition is gone is. Map findings to frameworks such as PCI DSS, ISO 27001, and NIST SP 800-53, and retain the evidence used for each mapping.
Worked example
A critical finding is due in 15 days. The owner deploys a patch on day 10. The reasoning: the ticket should move to pending verification, not closed. Retest the original proof-of-concept, confirm the vulnerable path no longer works, and attach the retest evidence. If the patch is delayed, document a time-bound risk acceptance with compensating controls rather than silently extending the SLA.
Traps
Closing tickets without retest. Defining SLAs without severity criteria. Accepting risk verbally. Mapping to a framework without evidence. Losing track of reopened findings after a regression.