Finding lifecycle

Step by step

1. Confirm scope Security Lead

   Security Lead checks the client, authorized targets, dates and authorization document.

   • Check client, authorized targets, dates and authorization document.
   • Updates Engagement scopes

2. Record finding Tester

   Tester links the asset issue to its engagement and records severity and evidence.

   • Link the asset issue to its engagement and keep severity and evidence.
   • Updates Security findings, Engagement scopes

3. Coordinate remediation Security Lead

   Security Lead moves an open finding into remediation after the response begins.

   • Move an open finding into remediation after the response begins.
   • Updates Security findings

4. Retest Tester

   Tester reviews the affected asset and recorded evidence before the final outcome.

   • Review the affected asset and recorded evidence before the final outcome.
   • Updates Security findings

5. Record outcome Security Lead

   Security Lead reviews the recorded outcome, keeping Closed distinct from accepted risk.

   • Keep closure and accepted risk distinct in the status.
   • Updates Security findings

Security Lead

, Tester, Admin.

The named reviewer makes the human decision where this process has a gate.

Use [roles](/penetration-test-management/roles) to rehearse what each person can see and change.