Glossary
Remediation plan
A document assigning every open finding an owner, a concrete action and a committed date, and recording its verified closure.
- Action plan
- Treatment plan
The difference between a remediation plan and a task list is four fields: a named owner — a person, not a department — a verifiable action, a committed date and closure evidence.
The field most often omitted and most valuable is the detection date, kept separate from the date the plan was approved. The distance between the two is what an auditor measures when deciding whether the organisation reacts, and it is what Article 21(4) of NIS2 means by correcting “without undue delay”.
Deadlines work better set by category than negotiated finding by finding. “Critical and exposed: seven days; critical and internal: thirty; everything else: monthly cycle” can be measured and can be visibly missed. A deadline agreed individually with each team cannot be audited, because there will always be a reason why that case was different.