GOV-007 Risk Treatment and Remediation Tracking
Description
Identified risks and control deficiencies have documented treatment plans with owners, target remediation dates, and current status. Progress against open findings is tracked and reported to management at defined intervals.
Rationale
Identifying and assessing risk has limited value unless treatment actions are assigned, tracked, and completed. A plan-of-action process closes the loop between assessment outputs and control improvement.
Applicability (9 profiles)
Framework Mappings (12)
| A&A-06 | Remediation | full |
| A&A-06 | Remediation | full |
| HIPAA-164.308.a.1.ii.B | Risk Management | full |
| NIS2-Art.21.4 | Corrective Measures on Non-Compliance | full |
| NIS2-CIR-2.1 | Risk Management Framework | informative |
| NIS2-CIR-2.3 | Independent Review of Information and Network Security | informative |
| NIS2-CIR-3.6 | Post-Incident Reviews | informative |
| CA-5 | Plan of Action and Milestones | full |
| PM-4 | Plan of Action and Milestones Process | full |
| RA-7 | Risk Response | full |
| MS-2.7-006 | AI System Security and Resilience Evaluation | MS-2.7-006 | full |
| CC4.2 | COSO Principle 17: Evaluates and Communicates Deficiencies | partial |
Evidence (2)
Plan of action and milestones (POA&M) or remediation tracker documenting open risk findings with owners, target dates, and current status.
Example: POA&M or remediation tracker (Jira board, GRC platform, or spreadsheet), showing each open finding from risk assessments or audits with: finding ID, description, assigned owner, target remediation date, current status, and management-reported aging.
Test: Request the current remediation tracker or POA&M. Verify: (1) findings from the most recent risk assessment and audit are present, (2) each finding has a named owner, (3) target remediation dates are set and non-expired items are on track or have documented extensions, (4) the tracker is reviewed and reported to management, confirmed via meeting minutes or a status report referencing open items.
Management-level report on remediation progress showing aging, closure rates, and overdue items.
Example: Monthly or quarterly remediation status report (Confluence / GRC dashboard) submitted to the CISO or equivalent, listing total open findings, overdue items, and items closed in the reporting period.
Test: Request the last two remediation status reports. Verify: (1) reports were produced within the defined cadence, (2) open, overdue, and closed finding counts are present, (3) overdue items have documented extensions or escalations, (4) reports are addressed to or acknowledged by a named manager.
Questions (3)
Does your organisation maintain a tracked plan of action for open risk findings and control deficiencies?
This may be a plan of action and milestones (POA&M), a remediation tracker, or equivalent. Findings from risk assessments and audits should appear in it with current status.
How often is remediation progress against open risk findings reported to management?
Regular management-level reporting (monthly or quarterly) with aging, closure rates, and overdue items is the expected practice.
What does each entry in the remediation tracker record?
Options run from the most commonly held to the least. An entry with no target date cannot age. A tracker where nothing ages reports the same picture every period.