The remediation plan
Assign findings to members with a due date and a status, comment on each one, filter “Mine”, get reminders, and export the plan as CSV or PDF.
The Remediation page is the plan of the findings your team has taken on: who fixes what, by when, where it stands, and a thread of comments for each one. It answers the question an assessor or a client asks after a report: what is being done about it?
The remediation plan is included from the Solo plan. On Free, the page says what it brings and links to the plans.
Put a finding in the plan
- Open a proved domain and unfold a finding of its latest report.
- Press Plan the fix.
- Choose who it is for and, if you like, a due date, then press Add to the plan.
The person it is given to receives an e-mail in their language, with a link to the finding. Once a finding is in the plan, its button becomes a line that says who has it, by when and where it stands; it opens the finding’s page in the plan. The domain’s page also has a Remediation plan card with its findings in the plan.
On the Solo plan, the workspace has one member: the plan is yours, with due dates, statuses, reminders and exports. To give findings to colleagues, invite them on the Agency plans (see Team members and roles).
Follow the plan
The Remediation page lists the findings in the plan, the soonest due first. Filter them:
| Filter | What it shows |
|---|---|
| To do | Findings still to fix: to do, in progress or overdue. |
| Overdue | Past their due date, and still found by the latest audit. |
| Mine | The findings assigned to you that are still to fix. |
| Accepted as a risk | Still found, but accepted as a risk: not fixed, and no reminders while the acceptance holds. If it expires or is closed, the finding is to do again from the next audit. |
| Fixed or done | Findings marked done, or no longer found by the latest audit of their domain. |
| All | Everything. |
Pick a domain in the list to see the plan of that domain only. Each line shows the finding, its domain, who has it, its due date, where it stands and how many comments it has.
A finding already accepted as a risk cannot be put in the plan: close the risk first. A finding the latest audit no longer sees shows as Fixed on its own, without anyone having to mark it: after a fix, Check if it is fixed on the finding confirms it at once (see Fix a finding and check that it is fixed).
A finding’s page
Open a finding of the plan to see its domain and target, whether the latest audit still finds it, who has it, its due date and status, and its thread: the comments of your team and every change, in order (put in the plan, assigned, due date set, status changed, reminders sent).
Who can do what
| Role | In the plan |
|---|---|
| owner, admin | Put any finding in the plan, give it to any member (not a viewer), set and change the due date and the status, comment, remove a finding from the plan. |
| member | Put a finding in the plan for themselves, take a finding nobody has, change the status of the findings assigned to them, comment. |
| viewer | Read the plan and its threads, export them. |
Every change is noted in the finding’s thread and in the workspace’s Activity (Settings). When a member leaves the workspace, the findings they had go back to nobody.
Reminders and calendar
The person a finding is assigned to gets a reminder by e-mail 3 days before its due date, and another one if the date passes while the finding is still there. A finding without anybody: the owners and admins are reminded. Nothing is sent for a finding that is done or no longer found.
The due dates of the findings still to fix are also in the deadline calendar.
Correction times
At the top of the page, Correction times measures how long findings stay open, from the audits kept by your plan: a finding counts as fixed once an audit no longer sees it. For each severity you see the target, how many findings were fixed in the last 12 months and how many within their target, the median time, and how many are open or late.
The default targets are 7 days for critical findings, 30 for high, 90 for medium and 180 for low. Owners and admins change them under Change the targets (a whole number of days, or empty for no target). A finding put in the plan without a due date gets the date of its target, counted from when the audits first saw it.
Evidence log (CSV) downloads one line per finding seen in the last 12 months: first seen, last seen, fixed, days taken, target and whether it was met. The file name carries the date and time of the export, and its SHA-256 is sent in the X-Content-SHA256 header, so a copy can be checked later. NIS2 asks you to handle vulnerabilities within defined times and to keep evidence of the results: this file is that evidence for what can be seen from the outside.
Export the plan
Export CSV and Export PDF give the plan with the filters of the page (for instance one domain, or your own findings). The PDF is in the language of the workspace, like the other reports, with each finding’s domain, who has it, its due date, where it stands and its latest comment.