Where plans stop
A security plan shows what is missing. Whether anything is then done about it is a separate question, and in many programs nobody is asking it.
FCR treats remediation as a pipeline with stages, so that progress through it can be seen.
Four stages
- Vulnerability identified. The inventory shows a control objective that is not in place.
- Risk selected. The team chooses to manage the risk that the gap creates.
- Handling committed. The team decides how: mitigate, accept, avoid or transfer.
- Inventory updated. The work is done, and the control inventory reflects it.
Where work is lost
Counting how many gaps reach each stage shows where the pipeline leaks. Two leaks are common.
- Between identified and selected. Many gaps are known and few are taken up. This is a triage problem: the team has not decided what to manage.
- Between committed and completed. Decisions have been made and the work is not finishing. This is an execution problem.
The two call for different help, which is why it is worth knowing which one a team has.
Count and weight
A count can mislead. A team may be working through many low-risk gaps while its most serious ones sit untouched. Weighing each gap by its risk shows whether attention is going where it matters.
A decision needs a plan
A commitment to mitigate is only a start. It needs a plan behind it, and it needs activity. A mitigation with no plan, or one that has not moved for a long time, has stalled, and someone should ask why.
The finish line
A gap is closed when the control inventory says so. Updating the inventory feeds the risk calculation and the next version of the security plan, so the record and the reality stay together.
When teams work on remediation together, the same record lets them coordinate, and lets the security office see where help is needed.