Remediation Plan
What this screen is for
This screen turns one compliance pack's evaluation into a plan of work for your tenant. Each failing item becomes an action: the operation that fixes it, who owns it, by when, and whether it is done. The plan is computed from the live evaluation, so it is never out of date with it.
The platform never re-encrypts your data and never destroys a key. Nothing runs until you preview a step and confirm it.
What must exist first
- The permission to read your tenant's analytics shows the plan, the previews, the executions and the attestations.
- Changing an action, executing a step and recording an attestation need the remediation write permission, held by tenant administrators and tenant key managers. Without it, those controls are not shown.
- Accepting a risk needs the risk acceptance permission, held by tenant administrators only.
- The pack is one the deployment licence includes. A pack it no longer includes keeps its plan, read-only (below).
Decisions you make here
Reading the summary
- Score today: the evaluation's score, unchanged.
- Projected score: the score the evaluation would give with every automatic and guided proposal applied. Decision actions and actions under a risk acceptance are left out.
- Keys to investigate: the keys whose algorithm no catalogue resolves. While any is listed, the score today and the projected score both read Incomplete, and no action shows a score delta: no proposal makes such a key evaluable.
- Progress: resolved actions out of the actions listed.
- Next deadline: the earliest effective day still ahead among the failing or warning calendar actions.
The server computes every figure; the console only shows them.
The three groups
- Automatic: the platform knows the fix, for example an expiry date within the maximum cryptoperiod. You still confirm it.
- Guided: the platform proposes a target algorithm, and you may choose another admissible one.
- Decision: only you can decide, for example how to handle a stateful hash-based signing key.
Open an action to see its steps, preview them and confirm.
Status
- Open and In progress are the states you set.
- Risk accepted shows while a risk acceptance is in force.
- Resolved shows as soon as the evaluation stops failing the item. It is set by the evaluation, never by hand.
A resolved item that fails again reopens.
Items you attest
Some items cannot be measured by the platform. Record an attestation for them: a statement, who attests, the assessment and expiry dates, and links to the evidence with their SHA-256. An attestation is shown beside the score and never changes it. The platform never opens the links.
A pack not included in your licence
When the licence no longer includes the pack, the plan is read-only under the notice This pack is not included in your licence, which asks you to Contact your platform administrator to add the pack back to the licence.
What was recorded while the pack was licensed stays readable: under Recorded follow-up, each action's owner, target date, risk acceptance and migration declaration; and the Executions recorded and Attestations recorded. Nothing is evaluated, so there is no score, projection, progress or deadline, and no control changes, previews, executes or attests anything, whatever your permissions.
What the plan never does
- It never destroys, archives, deletes or suspends a key.
- It never re-encrypts or re-signs your data; your applications do that when they choose to.
- It never runs on its own, and sends no reminders.
How it relates to other screens
The pack's evaluation lists the findings this plan comes from:
Each action has its own detail:
The catalogue shows which fix each kind of control gets: