Remediate Penetration Test Findings
Description
Remediate penetration test findings based on the enterprise’s policy for remediation scope and prioritization.
Implementation Checklist
Tool Recommendations
Continuous vulnerability assessment and exposure management across IT assets, cloud, containers, and OT
Tenable · Per-asset subscription
Cloud-based vulnerability management, detection, and response with integrated patch management and asset inventory
Qualys · Per-asset subscription
Vulnerability management platform with live dashboards, risk prioritization, and remediation workflows
Rapid7 · Per-asset subscription
Threats & Vulnerabilities (CIS RAM)
Threat Scenarios
Known Vulnerability Exploited After Unremediated Pentest Finding
ConfidentialityAn attacker exploits a vulnerability that was identified in a penetration test but never remediated because no process exists to track and prioritize the remediation of pentest findings.
Critical Finding Deprioritized Without Remediation Policy
IntegrityA critical penetration test finding is deprioritized by a development team focused on features because no organizational policy mandates remediation timelines based on finding severity.
Vulnerabilities (When Safeguard Absent)
No Remediation Process for Penetration Test Findings
Without a defined remediation scope and prioritization policy, penetration test findings are not systematically addressed, leaving identified vulnerabilities exploitable long after discovery.
Penetration Tests Produce Reports Without Accountability
Absence of remediation requirements means penetration test reports become shelf-ware, with findings acknowledged but never assigned, tracked, or verified as fixed.
Evidence Requirements
| Type | Evidence Item | Collection Frequency |
|---|---|---|
| Technical | Configuration screenshots or exports showing protection controls enabled | Captured quarterly |
| Document | Procedure documentation for protection measures | Reviewed annually |
| Record | Penetration test report and executive summary | Per engagement |
| Record | Remediation tracking and retest validation results | Post-engagement |
| Document | Governing policy document (current, approved, communicated) | Reviewed annually |