Remediation
What is Remediation?
The process of correcting identified deficiencies, vulnerabilities, or non-conformities to bring systems or processes into compliance.
Terms that appear alongside remediation
Each of these is named in at least one of the same controls as remediation. The number is how many controls name both.
- compliance 73 shared controls
- vulnerability 59 shared controls
- audit 58 shared controls
- policy 42 shared controls
- cybersecurity 35 shared controls
- governance 33 shared controls
- nist 28 shared controls
- incident response 28 shared controls
Frameworks that govern remediation
What the standards actually require on remediation
Requirements naming remediation across 6 standards, quoted from the control text.
Users should be able to verify that a remediation is authentic, through signed packages or secure download channels, so that a malicious update cannot be passed off as the fix.
iso-iec-29147-2018::7.8.2 · 7.8.2 Remediation authenticity →Vendors should develop and test remediations step by step. First, decide on the remediation: whether the vulnerability can be fixed completely, whether the impact of exploitation can be limited, or whether exposure can be cut, weighing speed against the testin...
iso-iec-30111-2019::7.1.5 · 7.1.5 Remediation development →Remove previous versions of [Assignment: organization-defined software and firmware components] after updated versions have been installed.
NIST800-SI-2(6) · SI-2(6) Flaw Remediation | Removal of Previous Versions of Software and Firmware →Security investigations, forensic analysis and remediation are done by qualified staff or third parties.
ffiec-cybersecurity-assessment-tool-cat::D3.CC.Re.Int.3 · D3.CC.Re.Int.3 Remediation (Intermediate 3) →The provider must have processes or mechanisms to report and deal with security incidents and vulnerabilities, whether suspected or confirmed, including: a secure channel through which customers can report incidents and vulnerabilities to the provider;
pci-dss-4-0::A1.2.3 · A1.2.3 Customer reporting and remediation of incidents and vulnerabilities →Operate a defined process for fixing vulnerabilities found in applications, using automated remediation where the vulnerability class allows.
CCM-AIS-07 · Application Vulnerability Remediation →Questions people ask about remediation
What is Remediation?
Why is Remediation important for compliance?
Which compliance frameworks address Remediation?
Where can I learn more about Remediation?
See how Remediation applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.