Remediation
Act on the findings
Report
Read the report
The report is written for the teams who will remediate the findings, manage the risk, and demonstrate governance. It opens with the run's state: complete; partial, scoped narrower than the plan, with the scope stated; or incomplete, with the reason and the workstreams not finished. It records the revision assessed, and it presents coverage as a table with 1 row per workstream: the workstream's state, the reason, and the count of items under each status label.
- The 5 status labels. Each applicable item carries exactly 1. DEMONSTRATED: a check ran and its output is captured. REASONED: derived from configuration, documentation, or a supplied document without execution, with the basis and the confirming check stated. GAP: the requirement is not met, and the evidence is cited. UNTESTED: not checked, with the blocking condition stated, the check that would resolve it, and who can run it. NOT APPLICABLE: the reason is stated.
- Severity. Critical, High, Medium, or Low is assigned to GAP findings only, each with its rationale, and it never exceeds the impact the evidence shows. A REASONED or UNTESTED item that would be a GAP if confirmed carries a potential impact on the same scale, labelled “potential impact if confirmed”, never a severity.
- Finding IDs. Each finding receives an ID of the form F-001 when it is first reported, numbered in the order first reported, and keeps it in every later re-issue and in every later run that is given the earlier report. An ID is never reused, even after its finding is resolved.
- Shared causes. Where a GAP has a root cause that could repeat, each instance is recorded as its own finding, and the instances that share a cause are linked to it, so that remediation fixes the cause once and re-verification checks every instance.
The report states, per requirement and per item of evidence, what was demonstrated, what was reasoned, what is a gap, what was untested, and what did not apply. It never characterizes the target as a whole as compliant, certified, secure, or complete. The labels, the severity anchors, and the report's sections are set out in the method: status labels, severity and risk, and the report and its recipients.
Plan
The remediation plan
Item 9 of the report is the prioritized remediation plan. For each item it gives the effort, the risk reduction, the trade-offs, the proposed owner, and the re-verification check, which is the check the audit prompt re-runs once you confirm that the change has been made. Each row of the findings register already names the remediation and its source; that is the change your team makes, in your own way and on your own schedule.
Item 10 lists the open questions and the items that need a human decision, and item 11 the limitations: tool access, source availability, untested items, and supplied documents not read in full. Where the plan names external recipients, the distribution version of the report keeps the status labels, the severity rationale, and the limitations in full, and it never omits a limitation or a GAP.
Changes
Make the changes and confirm them
The audit ends with the report. The audit prompt changes nothing in the project and applies no fix in any phase, whatever status an item carries and even if you ask for one: it runs nothing that writes, deploys, sends, deletes, or opens a listener, other than the project's own code under the execution option recorded in the plan, where a command you approve runs only as approved.
Your team makes the changes. When they are made, tell the assistant which findings you have addressed, by their IDs from the findings register. Keep the report and the plan it executed: the findings register is the input to the next step, the plan records the execution option and the authorizations, and the assistant asks you for either if it is not available. Your confirmation is a claim the prompt verifies, not evidence of a fix, and it changes neither how the project's own code may run (isolated; the owner's environment, per command; or none) nor the written authorization that active network probing needs.
Validation
What the audit prompt then does
For the findings you named, and for every finding linked to them by a shared root cause, the audit prompt then:
- re-runs the re-verification check the remediation plan records, or the check that established the finding, under the same rules, execution option, and authorizations as the assessment;
- records the result with the same 5 status labels and the same evidence standard: a finding is DEMONSTRATED only when its check ran again and its output is captured, and a check that cannot run leaves it UNTESTED with the condition stated;
- reports any check that still fails or could not run, and any new finding the re-check surfaces, with the next unused ID;
- re-issues the findings register with the same IDs and the updated statuses. No status is presented as current without a re-check, and a finding is never marked resolved on your confirmation alone. A finding you did not name, and that no named finding is linked to by a shared root cause, is not re-checked: its row shows the earlier report's status and date as that report's result, marked not re-checked. Items that remain GAP or UNTESTED stay visible.
Later
Run the audit again later
When you run the whole audit again later, give the planning prompt the earlier report with the other documents you supply. It is registered as a supplied document, self-reported, and the new report adds a comparison with it, each finding by its ID: new since that run; resolved, with the check that showed it; still open; changed in status or severity, with the reason; and not re-checked this time, with the reason.
A status from the earlier run is never carried forward; the new run establishes each one again. The IDs stay stable: a finding with the same requirement, component, and cause keeps its ID, and a new finding takes the next unused number, so the report shows what is new, what is resolved, and what is still open.
For the changes between 2 revisions, the skill's change review mode gives a partial assessment that keeps the finding IDs of the latest report it is given; it is never presented as an assessment of the project as a whole. See Install the skill and section 13 of the method.