What closes the loop after a release decision?
Decision to required action
- 01Release decision
- 02Required action
- 03Ownership
- 04Remediation
- 05Fix verification
- 06Updated decision
Remediation is governed work
A remediation plan names an owner, due date, target, and expected outcome. Ticket status can describe workflow progress, but it does not prove the security condition changed.
Verification needs new evidence
Fix verification re-tests the same condition against a saved report and target context. fendix verify can return verified fixed, still present, or unknown. A closed ticket without verification evidence does not close the finding.
What do I do with this?
Follow Remediation governance to assign work and preserve evidence. For temporary exceptions, use Release approvals. Exact fendix verify syntax is in the verify reference.