DEF-04
Fix, Retest, Prove
A remediation is not complete until the control change is retested and the resulting evidence closes or updates the finding.
governed lifecycle
DEF-04
Fix, Retest, Prove
A remediation is not complete until the control change is retested and the resulting evidence closes or updates the finding.
Governed remediation lifecycle from accepted finding through control implementation, retest, decision gate, closure, residual risk, or rework.
Remediation lifecycle
- 1Accept the findingConfirm scope, consequence, owner, and evidence state.
- 2Design the controlChoose the least disruptive change that addresses the supported path.
- 3Implement and instrumentChange the system and preserve the evidence needed to retest it.
- 4Retest the pathReplay the relevant conditions, alternatives, and expected controls.
Does the evidence support closure?
- Closed
- Residual risk
- Control failed
- Inconclusive