Remediation
Security header missing on the public app
Set a Content-Security-Policy at the edge for this host, then record the header in the next scheduled review. Do not copy a policy from another customer.
Sample estate. Example Owner. app.example.com
One desk for the test, the fix, and the incident note.
Continuous testing is a schedule on this desk. Remediation sits on the finding. Runbooks are the realtime protection steps a person follows. Assistants write the checklist. None of this starts a scan.
weekly
Ownership token re-check
Next record: Monday
Record only. A scanner is not launched.
daily
Dependency advisory review
Next record: tomorrow 07:00 EU
Record only. A scanner is not launched.
monthly
Edge header and admin-path review
Next record: first Monday
Record only. A scanner is not launched.
Findings
The same shape as a vulnerability desk: one component, one dedupe key, one status, one SLA. Repeats stay on the key. The rows below are samples.
Security header missing on the public app
header:content-security-policy:app.example.com
medium, active, inside
Dependency advisory on the sample ledger
advisory:EXAMPLE-2026-0142:ledger-web
high, verified, overdue
Admin path reachable without the office network
path:admin:app.example.com
critical, active, inside
Remediation
Dependency advisory on the sample ledger
Upgrade the named package in the lockfile, rebuild the sample service, and confirm advisory EXAMPLE-2026-0142 no longer matches. This sample advisory is not a live vulnerability.
Remediation
Admin path reachable without the office network
Restrict /admin to the office network, keep the existing login, and record who approved any exception. Do not publish the path in a ticket that leaves the account.
Status notes
Each note records the previous status, the new status, the reason, and who wrote it. No notice is sent, and no host is contacted.
Security header missing on the public app
active to active
The written review still matches this card. No notice was sent.
Recorded by Sample reviewer
Dependency advisory on the sample ledger
verified to verified
The sample advisory still matches this card. No notice was sent.
Recorded by Sample reviewer
Admin path reachable without the office network
active to active
The written path note is unchanged. No notice was sent.
Recorded by Sample reviewer
Retest checklist
Written checks, a recorded result, and the remediation already on the finding. A retest is not run.
Security header missing on the public app
- Read the remediation already written on this finding.
- Compare that text with the status note on this finding.
- Write the result on this checklist.
Result: Recorded. A retest was not run.
Set a Content-Security-Policy at the edge for this host, then record the header in the next scheduled review. Do not copy a policy from another customer.
Dependency advisory on the sample ledger
- Read the remediation already written on this finding.
- Compare that text with the status note on this finding.
- Write the result on this checklist.
Result: Recorded. A retest was not run.
Upgrade the named package in the lockfile, rebuild the sample service, and confirm advisory EXAMPLE-2026-0142 no longer matches. This sample advisory is not a live vulnerability.
Admin path reachable without the office network
- Read the remediation already written on this finding.
- Compare that text with the status note on this finding.
- Write the result on this checklist.
Result: Recorded. A retest was not run.
Restrict /admin to the office network, keep the existing login, and record who approved any exception. Do not publish the path in a ticket that leaves the account.
Advisory pack
Scope, out of scope, and risk accepted. The communications line is only a queue reference. Nothing is sent, and this pack does not accept a release.
- Scope
- The sample ledger package named on the dependency finding.
- Out of scope
- Any host outside this sample estate, and any live advisory feed.
- Risk accepted
- None. The sample finding stays verified until a person records another status from the existing set.
- Queue reference
- queue:sample:advisory-pack
Runbooks
Use these when a finding needs action now. A person performs the step. The desk does not log in anywhere.
Isolate
A critical finding is still active and the owner wants the host out of the public pool.
- Name the host and the finding id in the incident note.
- Remove that host from the public pool. Leave it powered so logs stay available.
- Do not reimage it in this step.
- Record the clock time and the person who moved it.
Preserve
Someone needs a record of what the host did before anything is changed.
- Export the logs for the window named on the finding.
- Record a hash of that export in the incident note.
- Do not delete the export or the original logs in this step.
- Store the note on this account only.
Notify
The owner and the customer contact need the same facts.
- Tell the named owner and the customer contact already on the account.
- Include the finding id, the severity, and the mitigation already written.
- Do not post a public statement from this desk.
- Write down who was told and when.
Rotate
The finding names a credential that should stop working.
- Rotate the credential the finding names.
- Revoke sessions that still use the old credential.
- Confirm the new credential is stored in the existing secret store.
- Record the rotation time. Do not write the secret into the note.
Who writes the note
Triage assistant
Orders the sample finding against its SLA and names the mitigation already on the card.
Containment assistant
Writes the isolate and preserve checklist. It does not move a host.
Communications assistant
Drafts who to tell. It does not send the message.