Control Deficiency & Remediation Tracker

Tracks deficiencies by severity through remediation and retest.

Available soon

Format: Excel
Size: 87 KB
Length: 12 sheets
Version: 1.0
Updated: 2 Oct 2026

Follow this documentFree account. We can email you when it changes.

What's inside

Instructions
Severity and Deadlines
Tracker
Exceptions Noted
Summary
Escalation
Lists
Definitions
Framework References

What changed

1.02 Oct 2026
Published.

Changes across this pack

Preview

The workbook's sheets as you will receive them, with its example rows and the values its formulas calculate. Highlighted [[text]] is for you to replace; rows marked EXAMPLE are for you to delete. Wide sheets scroll sideways. The cover, document control and changelog sheets are in the file.

Instructions

How to use this workbook

Step	What to do
1	What this tracker is. The record of every deficiency control testing finds, kept by the control assurance lead. A deficiency is a design that would not keep the risk in check, or an operating test concluded Not effective. Rated High, Medium or Low (CA-12). Exceptions found on a test concluded Effective are not deficiencies: record them on the Exceptions Noted sheet.
2	On the Severity and Deadlines sheet, confirm the settings: the days to fix by severity, the working days to agree a plan, and your public holidays. The defaults are the pack's (CA-13).
3	At the top of the Tracker sheet, set the As-at date: the date every overdue flag, plan check and count is worked out at. For the quarterly report, use the quarter's last day.
4	When the reviewer signs a workpaper that concludes a design Deficient or an operating test Not effective, add a row: the deficiency ID, the control, the workpaper, design or operating, and the finding in one or two sentences. Enter the date the reviewer confirmed it.
5	Answer the four severity questions: is it a key control; was a compensating control tested Effective; does the failure leave a risk outside appetite or a recorded unmet obligation without its control; or did the control run, with only its record falling short. The severity calculates (CA-12). A compensating control counts only once it has been tested Effective.
6	Name the register risk, or the recorded obligation, the failure leaves without its control, and its risk owner. Tell the risk owner at once and enter the date (CA-13). The plan-by date and the due date calculate from the date confirmed. A High deficiency goes to management in the next report: see the Escalation sheet.
7	Agree the remediation with the control owner by the plan-by date: what will change, who does it, and the work that fixes it. Where the fix is work another tracker already holds, such as a risk treatment action or a gap action, name it under 'Linked work' with its due date rather than starting a second action. Set the status to Plan agreed and enter the date agreed.
8	When the owner says the fix is in place, set Fixed, awaiting retest, enter the date it was fixed, and the date from which the fixed control will have run at least [[2]] times, or once for an annual or automated control (CA-14). Schedule the retest in the Annual Control Testing Plan.
9	The retest is an operating test by someone other than the owner, on its own workpaper. Enter the workpaper, who retested and the result. Only a passed retest closes a deficiency: then set Closed and enter the date. If it fails, plan the next fix and keep the row open.
10	If the fix cannot be in place by the due date, the owner asks for a P02 exception before that date (P02-A04 Security Exception Request & Approval Form and P02-A06 Security Exception Register). Once it is approved, set Deferred as an exception and enter the exception ID and its expiry. Without an approved exception the row shows overdue.
11	Each quarter, report the Summary sheet to the assurance sponsor: the counts by severity and state, and every deficiency past its due date by name (CA-19).
12	To start your own tracker, delete the contents of the first column and of every yellow cell on the Tracker and Exceptions Noted sheets. The formulas stay.

Legend

Yellow cells are inputs. Everything else is calculated or fixed — do not overwrite formulas.

EXAMPLE

Rows marked EXAMPLE in the first column show how a completed row looks. Delete them before approval.

Limitations: This document helps you test whether your security controls work. It is not legal advice, and a test result is not a statement that you comply with NIS2, DORA, the GDPR or any standard. Where a law, a certification or a contract asks for an audit or an independent review, confirm with counsel, your certification body or the other party what it must include.

Control testing is not an internal audit, a certification audit, a P19 maturity assessment or a statement of compliance, and is never presented as one. Its results can feed each of them. A closed deficiency means a retest passed. It is not an audit finding closed and not evidence of compliance.

CA-08 differs from P19's MA-05 on purpose. P19 rates a whole practice with its own checks, so a slip the practice caught and corrected itself is not a failure there. P20 tests one control: a failure another control caught is still this control's exception. The other control counts when the deficiency is rated, as a compensating control, if it has been tested Effective.

EXAMPLE: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders, an important entity under NIS2 in its Member State. Its pilot round, TR-2026-P, ran from 21 Sep 2026 to 25 Sep 2026, testing 1 Mar 2026 to 31 Aug 2026. It was led by its Quality and Compliance Manager and reviewed by its Internal Audit Manager on 28 Sep 2026. Two deficiencies, both High, both Open as at 30 Sep 2026, and one exception noted on an Effective test.

In the EXAMPLE, the fixes are work other packs already set: a risk treatment action (P05), a NIS2 gap action (P12) and a maturity action (P19). The tracker names that work and checks it falls due by the deficiency's due date. It does not start a second action for the same fix.

Tailoring — small organisation: one person may own most controls. The retest still needs someone else: a colleague from another function, internal audit or a contracted tester (CA-10, CA-14).

Tailoring — financial entity under DORA: where the internal audit of the ICT risk management framework finds the same weakness, follow up that finding by the audit's own rules. This tracker can show the control's retest; it does not replace the audit's follow-up.

This workbook is your own record. Keep it with the workpapers, where the control owners cannot change it (CA-20).

Severity and Deadlines

How severity and deadlines are set

The Tracker sheet uses the decision table, the days and the holidays on this sheet. Yellow cells are settings you may change; record any change in the Changelog.

The rules

Rule	What it says
CA-12	Every design deficiency and every Not effective result is a deficiency. High: a key control failed and no compensating control was tested effective, or the failure leaves a risk outside appetite or a recorded unmet obligation without its control. Medium: a key control failed but a compensating control was tested effective, or a control that is not key failed. Low: the control ran, but its record falls short of the evidence standard.
CA-13	The owner agrees a remediation plan within [[10]] working days and fixes the deficiency within [[90]] days for High, [[180]] for Medium and [[365]] for Low, from the day the reviewer confirms it. The risk owner is told at once; a High deficiency goes to management in the next report. A deficiency that cannot be fixed in time is deferred only as a P02 exception.
CA-14	A deficiency closes only when a retest passes. The retest waits until the fixed control has run at least [[2]] times, or once for an annual or automated control, and is made by someone other than its owner.

Severity decision table (CA-12)

Case	Key control	Compensating control tested Effective	Leaves a risk outside appetite or a recorded unmet obligation without its control	Evidence only: it ran, its record falls short	Severity (calc)	For example
Case 1	Yes	No	No	No	High	A key control failed, and nothing else that keeps the risk in check has been tested.
Case 2	Yes	Yes	No	No	Medium	A key control failed, but another control that keeps the same risk in check was tested Effective.
Case 3	No	No	No	No	Medium	A control that is not key failed.
Case 4	No	No	Yes	No	High	A control that is not key failed, and its failure leaves a risk outside appetite without its control.
Case 5	No	Yes	Yes	No	Medium	As above, but a compensating control was tested Effective for the same period.
Case 6	Yes	No	No	Yes	Low	The control ran each time, but its record falls short of the evidence standard: for example, an approval with no date.

Evidence only is checked first: a control that ran, with a record short of the evidence standard (Control Evidence Standards Checklist), is Low whatever else applies. A control that did not run is never Low.

Deadlines (CA-13)

Severity or setting	Days	What it means
High	90	Calendar days to fix a High deficiency, from the day the reviewer confirms it.
Medium	180	Calendar days to fix a Medium deficiency, from the day the reviewer confirms it.
Low	365	Calendar days to fix a Low deficiency, from the day the reviewer confirms it.
Plan agreed within	10	Working days, Monday to Friday less the holidays below, for the owner to agree a remediation plan.

Public holidays (optional)

The plan-by date skips weekends and any date listed here. Due dates are calendar days and do not skip them.

[[Your public holidays]]

The states of a deficiency

State	What it means	Who sets it
Open	The reviewer has confirmed the deficiency. The owner has not yet agreed a remediation plan.	Control assurance lead, on the day the reviewer confirms it
Plan agreed	The owner has agreed what will change, who does it and by when, within [[10]] working days of confirmation (CA-13).	The control owner, with the assurance lead
Fixed, awaiting retest	The owner says the fix is in place. The deficiency stays open until a retest passes. The retest waits until the fixed control has run enough times to sample (CA-14).	The control owner
Closed	A retest by someone other than the owner passed. Only a passed retest closes a deficiency (CA-14).	Control assurance lead, on the retest's reviewed workpaper
Deferred as an exception	The deficiency cannot be fixed by its due date, and the deferral was approved as a P02 exception before that date. The exception's expiry becomes the new date to meet (CA-13).	Control assurance lead, once the exception is approved

Tracker

One row per deficiency, from the test that found it to the retest that closes it. Yellow columns are yours; the others calculate. Severity follows CA-12, the dates CA-13, closure CA-14. Flags are worked out at the As-at date below.

Row	Deficiency ID	Control ID	Control (calc)	Test workpaper	Design or operating	Finding	Key control?	Compensating control tested Effective?	Leaves a risk outside appetite or unmet obligation without its control?	Evidence only: it ran, its record falls short?	Severity (CA-12, calc)	Confirmed by the reviewer on	Risk or obligation it leaves without its control	Risk owner	Risk owner told on	Plan agreed by (calc)	Due (CA-13, calc)	Control owner	Remediation	Linked work that fixes it	Linked work due by (the latest)	Linked work timing (calc)	Related work (the fix does not wait for it)	Status	Retest from (CA-14)	Overdue flag (calc)	Plan check (CA-13, calc)	Retest and closure check (CA-14, calc)	Notes
As-at date	30 Sep 2026	Every overdue flag, plan check and count is worked out at this date. For the quarterly report, the quarter's last day.
EXAMPLE	DF-01	CT-13	Urgent vulnerabilities fixed in time	WP-2026-02	Operating	Two of five sampled Priority 1 and 2 findings were fixed after their deadlines with no deferral.	Yes	No	No	No	High	28 Sep 2026	R-05 Critical weaknesses on internet-facing systems exploited before they are fixed (P05)	Head of IT	28 Sep 2026	12 Oct 2026	27 Dec 2026	Head of IT	Bring the ordering platform's patching back within deadline, and defer every miss as an exception before its deadline	P05 TA-03, P05-A07 Risk Treatment Plan: Bring the ordering platform's patching back to 95% within deadline after two engineers left (Head of IT, due 31 Oct 2026)	31 Oct 2026	Due in time	P19 MF-11, P19-A06 Maturity Findings & Improvement Tracker: Bring the most urgent fixes back to deadline, with every miss deferred as an exception (Head of IT, due 29 Jan 2027)	Open	2 Nov 2026	Not due	Plan due	Not ready for retest	Planned in the Annual Control Testing Plan: Feb 2027, retest test: DF-01 retest; Higher: first of two. The related work goes on after the fix; the deficiency does not wait for it.
EXAMPLE	DF-02	CT-02	Policy reviews on time	WP-2026-07	Design	No register records when each policy is due for review, and there is no cryptography policy.	Yes	No	Yes	No	High	28 Sep 2026	NIS2 measure (h), which the board recorded as outstanding (P12)	No register risk		12 Oct 2026	27 Dec 2026	Head of Information Security	Keep a policy register with an approval and review date for every policy, and have the board approve the cryptography policy	P12 GAP-01, P12-A08 NIS2 Gap & Remediation Tracker: Write the policy and have the board approve it on 29 Oct 2026, completing its approval of the measures (NR-03) (Head of Information Security, due 30 Oct 2026); P19 MF-01, P19-A06 Maturity Findings & Improvement Tracker: Approve a cryptography policy, and keep a policy register with an approval and review date for every policy (Head of Information Security, due 18 Dec 2026)	18 Dec 2026	Due in time		Open	1 Feb 2027	Not due	Plan due	Not ready for retest	Planned in the Annual Control Testing Plan: Jan 2027, design test: DF-02: design re-checked once the register exists; Jul 2027, retest test: DF-02 operating retest; Higher.

Exceptions Noted

Exceptions found on tests concluded Effective (CA-07). They are not deficiencies, but each is named. A failure another control caught is still this control's exception (CA-08).

Row	Test workpaper	Control ID	Control (calc)	Test conclusion	Occurrence	What happened	Treatment (calc)	Notes
EXAMPLE	WP-2026-01	CT-16	Leavers' access removed	Effective	L-2026-031	ERP account disabled 19 days after the last working day, by the May reconciliation (CT-18)	Recorded: not a deficiency (CA-07)	L-2026-031's ERP account stayed enabled for 19 days after the last working day. The May reconciliation (CT-18) found and disabled it. One exception, so five more leavers were tested (CA-07): none failed. Effective, with the exception recorded and CT-18 noted as having caught it (CA-08).

Summary

Summary

Every figure is worked out from the Tracker and Exceptions Noted sheets at the As-at date. Report it to the assurance sponsor each quarter. Counts only, with every overdue deficiency named: no percentage, score or weighting (CA-19).

As at	30 Sep 2026

EXAMPLE: the deficiencies from TR-2026-P, as at the date above.

Deficiencies by severity and state

Severity	Open	Open (not closed)
High	2	2
Medium	0	0
Low	0	0
All	2	2

A row with no severity yet is not counted here: answer its severity questions. Deferred as an exception counts as open: an exception postpones the fix, it does not close the deficiency.

Measures

Measure	Result	What it counts
CAM-04 Open deficiencies by severity	High 2, Medium 0, Low 0	Deficiencies not yet closed by a passed retest, counted High, Medium and Low. Target: No High open past its due date.
CAM-05 Deficiencies past their due date	None	Deficiencies not yet fixed when their due date passed, with no approved deferral, by name. A deficiency fixed by its due date and waiting for its retest is open (CAM-04) but not past due. Target: None. Named in the table below.
High deficiencies past their due date	0	The assurance sponsor decides on each (CA-13).
Plans not agreed in time	0	Plans agreed after, or still open past, the [[10]] working days CA-13 allows.
Deferred as an exception	0	Each needs an approved P02 exception and its expiry.
Fixed, awaiting retest	0 (0 can be retested now)	A retest waits until the fixed control has run at least [[2]] times (CA-14).
Closed on a passed retest	0 of 0 closed	Every closed row should have one.
Closure problems (CA-14)	0	Should be 0. Re-open the row and arrange a retest by someone other than the owner.
Linked work due after the deficiency	0	Should be 0. Bring the linked work forward, or start the fix here.
Exceptions noted on Effective tests	1	Named on the Exceptions Noted sheet. Not deficiencies (CA-07).
Deficiencies in the tracker	2	Every row with a deficiency ID, open or closed.

EXAMPLE, as at 30 Sep 2026: CAM-04 High 2, Medium 0, Low 0; CAM-05 None.

Past their due date, by name

#	Deficiency ID	Control ID	Severity	Due	Days past due	Flag

The first 10 in tracker order. Filter the Tracker sheet's Overdue flag for the full list.

Quarterly report record

Item	Entry
Reported to the assurance sponsor by (name, role) and date	[[Name, role, YYYY-MM-DD]]
High deficiencies taken to management this quarter	[[e.g. DF-01 and DF-02, at the board meeting on YYYY-MM-DD]]
Deficiencies past their due date, and the decision on each	[[e.g. none; or the deficiency, the reason and the decision]]
Deferrals approved as P02 exceptions	[[e.g. none; or the exception ID and its expiry]]

Escalation

Who is told, and when

A deficiency is the control owner's to fix, but others need to know it exists, and some decide what happens when it is late.

Who	When	What they get or do	Rule
Risk owner	At once, when the reviewer confirms the deficiency	Is told of every deficiency in a control their risk relies on, and decides whether the risk must be reassessed.	CA-13
Control owner	At once, when the reviewer confirms the deficiency	Agrees a remediation plan within [[10]] working days, and fixes the deficiency within [[90]] days for High, [[180]] for Medium and [[365]] for Low.	CA-13
Head of Information Security	When the plan is drafted	Owns the security controls in the inventory and their content, and agrees each deficiency's remediation. Tests none of them.	CA-13
Management (approver)	In the next report after a High deficiency is confirmed	Receives High deficiencies and the assurance results, and accepts any risk left while a deficiency stays open.	CA-13
Assurance sponsor	When any deficiency passes its due date with no approved deferral	Is told by name in the next report, and decides what happens to a High deficiency past its due date: more resource, a new date, or a deferral as an exception.	CA-13, CA-19
The approver of a P02 exception	Before the due date, when the owner knows the fix will not be in place	Decides the deferral as a P02 exception, at the level the exception's band sets (Low: no longer than 365 days; Medium: no longer than 180 days; High: no longer than 90 days; Critical: no longer than 30 days). Without an approved exception the deficiency is overdue.	CA-13
Control assurance lead	Throughout	Rates each deficiency, keeps this tracker, schedules each retest once the fix has run, and reports the counts each quarter.	CA-12, CA-14, CA-19

Deferring a deficiency

Step	What to do
Before the due date	The owner asks for an exception on the P02 request form (P02-A04 Security Exception Request & Approval Form and P02-A06 Security Exception Register), naming the deficiency ID, why the fix is late, what keeps the risk in check meanwhile, and the new date.
Approval	The approver the exception's band sets decides. A deficiency is never deferred by the assurance lead or the control owner alone.
In this tracker	Set Deferred as an exception and enter the exception ID and its expiry. The row stays open and is counted as open.
At expiry	The fix is in place and the row moves on, or the exception is renewed or escalated under P02's rules. An expired exception shows the row overdue.

Mistakes to avoid

Mistake	What goes wrong	The fix
PF-04	Explaining away an exception because another control caught it.	Record it as an exception of this control; the other control counts when the deficiency is rated (CA-08, CA-12).
PF-06	Closing a deficiency when the owner says it is fixed.	Close only on a passed retest after the fixed control has run (CA-14).

Lists

State	Severity	YesNo	Kind	RetestResult	Conclusion	ControlID	ControlName
Open	High	Yes	Design	Passed	Effective	CT-01	Board report from checked figures
Plan agreed	Medium	No	Operating	Failed	Not effective	CT-02	Policy reviews on time
Fixed, awaiting retest	Low				Not tested	CT-03	Joiners acknowledge policies
Closed						CT-04	Quarterly risk review
Deferred as an exception						CT-05	Exceptions approved and renewed in time
						CT-06	Monthly exception register review
						CT-07	Tier 1 suppliers reassessed in time
						CT-08	Metric inputs checked before reporting
						CT-09	NIS2 readiness self-assessed
						CT-10	Board members trained
						CT-11	Information register reviewed
						CT-12	Disposal certificates collected
						CT-13	Urgent vulnerabilities fixed in time
						CT-14	Vendor releases reviewed
						CT-15	Missed patch deadlines deferred
						CT-16	Leavers' access removed
						CT-17	Movers' old access removed
						CT-18	Monthly account reconciliation
						CT-19	User access reviews
						CT-20	Privileged access reviewed
						CT-21	Break-glass accounts tested and every use reviewed
						CT-22	Security induction completed
						CT-23	Annual security course completed
						CT-24	Post-incident review held
						CT-25	Incident response exercised
						CT-26	After-action report approved
						CT-27	Notification readiness checked
						CT-28	Maturity assessed each year
						CT-29	Supplier High findings escalated
						CT-30	Triggered risk reassessment

Definitions

Definitions

Term	Meaning in this workbook
Deficiency	A design that would not keep the risk in check, or an operating test concluded Not effective. Rated High, Medium or Low (CA-12).
Exception	A sampled occurrence that fails any attribute (CA-07, CA-08).
Control	Something done routinely to keep a risk in check, written as who does what, how often, and the record it leaves (CA-01).
Key control	A control whose failure, on its own, would let a risk on the register happen or go unnoticed, or that the organisation names as its evidence for an obligation. Key controls are never rated Lower risk.
Compensating control	Another control that keeps the same risk in check when this one fails. It counts only once it has been tested and found effective (CA-12).
Control owner	The manager accountable for a control running and leaving its record. Agrees test dates, provides access to records and fixes deficiencies.
Tester	The person who tests a control. Owns and performs none of the controls they test (CA-10).
Workpaper	The record of one test: population and its source, sample, attributes, results, exceptions, conclusion, tester and reviewer (CA-11).
Retest	An operating test of a fixed control, made after it has run enough times to sample, by someone other than its owner. A deficiency closes only on a retest that passes (CA-14).
High	A key control failed and no compensating control was tested Effective, or the failure leaves a risk outside appetite or a recorded unmet obligation without its control (CA-12). Fix within [[90]] days.
Medium	A key control failed but a compensating control was tested Effective, or a control that is not key failed (CA-12). Fix within [[180]] days.
Low	The control ran, but its record falls short of the evidence standard (CA-12). Fix within [[365]] days.
States	Open, Plan agreed, Fixed, awaiting retest, Closed, Deferred as an exception. What each means and who sets it: the Severity and Deadlines sheet.
Confirmed	The day the workpaper reviewer signs the conclusion that found the deficiency. Plan and due dates count from it (CA-13).
Plan agreed by	The date [[10]] working days after confirmation, skipping weekends and the holidays on the Severity and Deadlines sheet.
Due	The date confirmed plus the days to fix for the severity, in calendar days. A deficiency not fixed by then is overdue unless an approved P02 exception defers it. One fixed by its due date and waiting for its retest is open but not overdue.
Retest from	The first date on which the fixed control will have run at least [[2]] times, or once for an annual or automated control (CA-14).
Linked work	An action another tracker already holds that fixes the deficiency, named here so the fix is not started twice. It must fall due by the deficiency's due date.
Related work	Later work on the same practice that the fix does not wait for.
Exception noted	An exception on a test that was still concluded Effective under CA-07. Recorded and named; not a deficiency.
As-at date	The date every overdue flag, plan check and count is worked out at.
Control assurance lead	The person who runs control testing: keeps the inventory and the plan, assigns testers, reviews workpapers, and rates deficiencies. Owns and performs no control in scope.
Assurance sponsor	The member of management who approves the test plan, receives the dashboard, and decides when a High deficiency is overdue.
(calc), (working)	A column or cell the workbook calculates. Do not type or paste over it. Working columns hold values other formulas read.
CA-nn, CT-nn, CAM-nn	The rules, controls and headline measures of the Control Testing Methodology. WP- are test workpapers (Control Test Workpaper Template); DF- are deficiencies in this tracker. P05, P12 and P19 IDs are actions in those packs' trackers.
EXAMPLE	A worked example: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders, after its pilot round TR-2026-P, as at 30 Sep 2026. Delete before use.

Framework References

Framework references

These references indicate relevance only and do not reproduce the text of any standard.

Framework	Reference	Supported by
ISO/IEC 27001:2022	Clause 10.2 — Nonconformity and corrective action	Tracker sheet: each deficiency rated, corrected by its owner, and closed only when a retest shows the correction worked
NIST CSF 2.0	ID.IM-01 — “Improvements are identified from evaluations”	Tracker sheet: the improvements identified from control tests, with owners and dates
NIS2 — Directive (EU) 2022/2555	Article 21(4) — an entity that finds that it does not comply with the measures in paragraph 2 takes, “without undue delay, all necessary, appropriate and proportionate corrective measures”	Tracker sheet: each control found not working becomes a deficiency with an owner, a plan and a due date, followed until a retest shows it corrected. Where the control is one of the entity's Article 21(2) measures, the tracker records the corrective measures taken
NIS2 — Implementing Regulation (EU) 2024/2690	Article 1 — lays down the technical and methodological requirements of the Article 21(2) measures, and further specifies when an incident is significant, for DNS service providers, TLD name registries, cloud computing, data centre and content delivery network providers, managed service and managed security service providers, providers of online marketplaces, online search engines and social networking services platforms, and trust service providers	Applies to the providers its Article 1 names. For them, the Annex point below; for others, a useful guide only
NIS2 — Implementing Regulation (EU) 2024/2690	Annex, point 2.3.3 — the results of the independent reviews, including the results of compliance monitoring (point 2.2) and of monitoring and measurement (point 7), are reported to the management bodies; “Corrective actions shall be taken or residual risk accepted according to the relevant entities’ risk acceptance criteria.”	Summary and Escalation sheets: deficiencies reported to management, each corrected or, where it is deferred, the residual risk accepted through an approved exception. For the providers Article 1 names, the results can feed the independent review; the tracker is not that review
DORA — Regulation (EU) 2022/2554	Article 6(7) — “Based on the conclusions from the internal audit review, financial entities shall establish a formal follow-up process, including rules for the timely verification and remediation of critical ICT audit findings.”	Tracker sheet, for financial entities: the same follow-up discipline (owner, date, verification by someone else) as a formal follow-up process. It does not replace the follow-up of internal audit findings, which the audit's own process governs
DORA — Delegated Regulation (EU) 2024/1774	Article 28(6) — “Based on the outcome of the audit referred to in paragraph 5, the financial entities referred to in paragraph 1 shall ensure the timely verification and remediation of critical ICT audit findings.”	Tracker sheet, for entities under the simplified framework: closure only on verification. The audit's critical findings are followed up under the audit's own rules
GDPR — Regulation (EU) 2016/679	Article 24(1) — the controller implements appropriate technical and organisational measures to ensure, and to be able to demonstrate, that processing is performed in accordance with the Regulation; “Those measures shall be reviewed and updated where necessary.”	Tracker sheet: measures found wanting are updated, with a record that shows it was done and checked
GDPR — Regulation (EU) 2016/679	Article 32(1)(d) — the security measures include, as appropriate, “a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of the processing”	Tracker and Exceptions Noted sheets: what testing the effectiveness of security measures found, and what was done about it

Editions referenced: ISO/IEC 27001:2022 incl. Amd 1:2024; NIST CSF 2.0; Directive (EU) 2022/2555 (NIS2) and Implementing Regulation (EU) 2024/2690; Regulation (EU) 2022/2554 (DORA) and Delegated Regulation (EU) 2024/1774; Regulation (EU) 2016/679 (GDPR)

ISO/IEC 27001 references name the clause or control this document relates to. They do not say that meeting it meets any other framework's requirement.

These references show where this document supports an external framework. They indicate relevance only and do not reproduce the text of any standard.