Service scope
Remediate findings and retest the change. The change request is agreed separately.
From finding to change
A change does not start with unrestricted write access. The proposed process begins with a documented finding, a bounded change request and a verifiable objective.
Agree before remediation
- Who may approve which change?
- What backup and rollback options exist?
- When may changes be made?
- Which test will verify the outcome?
Separate engagement
Assessment, remediation and retesting are distinct activities. Availability, permissions and responsibilities must be agreed in advance.
Related reading
Which findings would you like addressed?
Changes and retesting are agreed separately.