Build a remediation plan
-
01
Validate
Confirm the resource, finding evidence, current scope, and practical impact.
-
02
Prioritize
Consider exposure, reachability, data, identity, business importance, active threats, and coverage.
-
03
Assign
Name an accountable owner, safe change path, target date, and required approval.
-
04
Change
Apply the approved control change in the provider or owning system.
-
05
Verify
Use new source evidence to confirm the intended condition and record the outcome.
Use exceptions carefully
An exception records an approved decision not to complete the expected change within the normal path. It should identify the exact resource and condition, business reason, accountable approver, compensating controls, review date, and expiry.
An exception changes workflow state. It does not change the observed evidence, remove the underlying condition, or guarantee that compensating controls are effective.
Close with evidence
- Confirm that the intended provider change completed successfully.
- Wait for current evidence from the affected scope and review the new assessment.
- Check that related exposure or attack paths changed as expected.
- Record partial success, residual risk, or new evidence instead of forcing a closed result.