If remediation deadlines are routinely missed, do we change the deadline, the capacity or the scope?

Start

Remediation deadlines are routinely missed

A standard that is routinely missed is worse for audit than a realistic one that is met. The pack treats a priority that stays below 90% adherence as a sign that its deadline or the capacity behind it is wrong. The misses are evidence. The question is which lever they point to.

• Then: Is someone proposing to lower priorities or scan less?

Decision

Is someone proposing to lower priorities or scan less?

These are the tempting shortcuts, and they change the figures without changing the risk. Lowering a priority, rating fewer findings Priority 1 or 2 by narrowing what counts as critical, dropping systems from scanning, or renewing exceptions without review all make adherence look better while exposure stays the same.

• Yes: Don't lower priorities or shrink scope to meet deadlines
• No: Look at adherence and time to fix, by priority, over time

Outcome

Don't lower priorities or shrink scope to meet deadlines

A priority may be lowered only when a control changes one of its inputs, never to avoid a missed deadline. A fall in open findings alongside a fall in scan coverage is not an improvement. A rising number of exceptions can hide falling adherence. Set the shortcut aside and look at the real causes.

• Then: Look at adherence and time to fix, by priority, over time

Step

Look at adherence and time to fix, by priority, over time

Use several periods, because one period rarely tells you much and a handful of closures swings the average. An average time to fix above the deadline means the typical finding is late. Also look at findings now overdue, by priority and owner, and at the age of the oldest.

• Then: Do the figures measure what they should?

Decision

Do the figures measure what they should?

Check three things before acting on them. Deadlines must count from first detection, and rescans must keep that date. A finding counts as fixed on the date a rescan or other objective evidence confirms it; a closed ticket is not enough. The scanner review must say the figures are ready to report. If any of these is uncertain, answer no.

• Yes: Are the misses concentrated in a few owners or systems?
• No, or not known: Correct how the figures are produced, then measure again

Step

Correct how the figures are produced, then measure again

Restore original detection dates, close findings only on verified evidence, and fix the scanner checks that affect the figures. The result may be better or worse than you thought. Either way, it is the one to decide on.

• Then: Look at adherence and time to fix, by priority, over time (back to an earlier step)

Decision

Are the misses concentrated in a few owners or systems?

Group the overdue findings by asset owner, team, service provider and system. A few names carrying most of the misses is a different problem from misses spread evenly across the estate.

• Yes: Treat it as a capacity or ownership problem for those owners
• No, they are spread: Is the priority mix inflated by missing asset data?

Outcome

Treat it as a capacity or ownership problem for those owners

Findings escalated often usually point to a capacity problem. Disputed ownership is the most common reason findings go unfixed, so settle it and correct the inventory. Escalate on the fixed rule and ask for a decision: more time or people, a compensating control, or an exception. For a service provider, use the deadlines in its agreement.

Decision

Is the priority mix inflated by missing asset data?

Unknown exposure counts as internet-facing and unknown criticality as Critical, so gaps in the inventory push findings into short deadlines. The pack's quarterly signals: Priority 1 regularly above 5% of new findings, many inputs defaulted because they were unknown, or more than 10% of findings raised or lowered. If you have not checked, answer yes.

• Yes, or not known: Fix the inventory and keep the defaults, then measure again
• No: Are old or unsupported systems behind many of the misses?

Step

Fix the inventory and keep the defaults, then measure again

Have asset owners confirm exposure and criticality for the systems carrying defaulted inputs. Findings then fall to their real priority through the proper route. Softening the defaults instead would make every gap in the inventory cheaper to leave open.

• Then: Look at adherence and time to fix, by priority, over time (back to an earlier step)

Decision

Are old or unsupported systems behind many of the misses?

Systems the vendor no longer supports often produce findings that cannot be fixed on any deadline. They inflate the misses for reasons capacity cannot solve. If you do not know which systems are unsupported, answer yes and find out.

• Yes, or not known: Reduce scope by retiring them, with exceptions until then
• No: Does a regulation or contract fix the deadline that is missed?

Outcome

Reduce scope by retiring them, with exceptions until then

This is the honest way to change scope: remove the exposure. Record each unsupported system with its compensating controls and a planned retirement date, and review it at least quarterly. Findings it cannot fix go through the exception process in the meantime. A retired system's findings close once the inventory and retirement records are updated and the system no longer answers scans.

Decision

Does a regulation or contract fix the deadline that is missed?

Some deadlines are set from outside. Where the payment card standard applies, patches for critical vulnerabilities are expected within one month of the patch's release. That month runs from release, not from detection, so a finding found late can miss it even inside the pack's 30-day Priority 3 deadline. Check your own regulatory and contractual commitments too. If you are not sure, answer yes.

• Yes, or not known: Take a capacity decision to management
• No: Test the deadline against recent real volumes

Step

Test the deadline against recent real volumes

Rate the last three months of findings and count how many would have missed their deadline with the capacity you actually have. Use the pack's test from before approval: if more than a fifth of Priority 2 and 3 findings would be overdue, add capacity or agree a longer deadline. Remember that deadlines do not reflect effort; a platform upgrade and a one-line change get the same one.

• Then: Could realistic extra capacity meet the current deadline?

Decision

Could realistic extra capacity meet the current deadline?

Capacity includes people and time, and also process: a reliable patch cycle, a weekly triage that assigns owners, and fixes made at the source, such as an outdated build image. If you cannot tell whether more capacity would work, try it before lengthening the deadline.

• Yes, or not known: Take a capacity decision to management
• No: Propose a longer deadline to the approver, backed by evidence

Outcome

Take a capacity decision to management

Put the figures, the cause and the options to management: more people, agreed maintenance windows, or process changes. In the pack's self-assessment, a mature programme is one where repeated overdue findings lead management to change capacity or process. The same self-assessment shows which part of the programme to strengthen first.

Outcome

Propose a longer deadline to the approver, backed by evidence

The approver of the standard approves its deadlines. Change the standard and the rating method in the same approval, with the evidence from the re-test. Keep reporting adherence against the new deadline. A realistic deadline that is met is easier to defend than one that is routinely missed.