Monitoring · The findings log · Element
The finding
What was found, and how serious it is.
The part
What it is
Severity should reflect the consequence of the control failing rather than the effort required to fix it.
A finding should describe the condition rather than the remedy, so that the person fixing it can choose how.
The smallest level
The attributes it carries
Each attribute is one of the framework’s shared types. What a date is, and how it is written, is defined once for the whole model — the note here says what it means in this particular place.
The other elements in the findings log
The action
What is being done, by whom, and by when.
LearnThe closure
Verification that the finding was actually resolved.
Learn