Management prepares a remediation plan to formally manage the resolution of findings identified in risk assessment activities.
Risk assessments find and prioritize risks, but that information and insight is only useful if it's acted on. This control aims to ensure the risks we find in risk assessments are appropriately acted on and remediation efforts are seen to their full completion.
This control applies to all risk assessments and their respective risk findings.
Non-public information relating to this security control as well as links to the work associated with various phases of project work can be found in the Remediation Tracking control issue.
Examples of evidence an auditor might request to satisfy this control: