Skip to content

Work a remediation plan and attest it

Turn a compliance pack's failing items into work: preview and run the steps that fix your keys, record who owns each action and by when, and attest the items the platform cannot measure.

Who can do it

A tenant administrator or a tenant key manager. Anyone who can read the tenant's analytics sees the plan, its previews, executions and attestations; changing an action, running a step and recording an attestation need the remediation write permission, and without it those controls are not shown. Running a step also needs the step's own permission, such as rotating or creating keys. Recording a risk acceptance is for tenant administrators only.

Before you start

  • The deployment licence includes the pack. A pack it no longer includes keeps its plan, read-only.
  • The plan never destroys, archives, deletes or suspends a key, and never re-encrypts or re-signs your data: your applications move their data when they choose to. Nothing runs until you preview a step and confirm it.

Steps

  1. Open Compliance evaluation, select View detail and plan on the pack, then the Remediation plan tab. The summary shows Score today, When the plan is complete, Progress and Next deadline, and the actions are grouped as Automatic, Guided and Decision.
  2. On an action, select Open the action.
  3. Under Steps, select Preview on the step you want. The preview changes nothing: it lists the keys a page at a time, with each key's current algorithm, the proposed target and expiry, and why a key cannot be changed. Where an action offers two options, rotating the key or creating a successor key and then revoking the superseded one, each option says how many keys it applies to.
  4. Where the preview lists Conflicts with other licensed packs, tick each one to acknowledge it.
  5. Select the confirm button, which shows how many keys the step runs on. The dialog then shows each key's outcome and The plan now, with the Action status and the Pack score.
  6. Under Follow-up, set the Owner, the Target date and the Status, and select Save follow-up. A tenant administrator can record a Risk acceptance with its Reason and Accepted until date, at most one year ahead, with Record risk acceptance.
  7. For an item the platform cannot measure, go back to the plan and, under Items you attest, select Record attestation. Fill in the Statement, Attested by, Assessed on and Expires on, add one to ten Evidence links, each with the SHA-256 of what it points at, and select Record.

What you see when it worked

A step that ran reports how many keys it moved and each key's outcome: done, already done, refused, failed or outcome unknown. Outcome unknown means a rotation was sent and no answer came back, so it may have been applied; a later run checks the key again. The action shows Resolved as soon as the evaluation stops failing the item: it is never set by hand, and a resolved item that fails again reopens.

An attestation is shown beside the score and never changes it. Every execution and attestation is listed on the plan, and every change is written to your audit log.

If it fails

What you see Cause What to do
The keys changed since this preview The keys or the pack changed since the preview, or the preview is from an earlier day Preview again, then confirm
A conflict is not acknowledged The targets you chose newly fail items of another licensed pack Acknowledge each conflict and confirm again, or preview again
Another run of this action is still going An action runs once at a time When the other run has finished, preview again and confirm
This confirmation is still running The same confirmation was sent again before it finished Select Ask again in a moment to see its outcome
Executing this step needs every one of these permissions Your role lacks one of the step's own permissions Ask a person who holds them
Someone else changed this action Another person saved the follow-up first; nothing was saved Review the action as read again and save once more
The attestation was not recorded A field was refused, or the item is not one that is attested Read the reason shown, correct it and record again
This pack is not included in your licence The licence no longer includes the pack The plan is read-only; contact your platform administrator to add the pack back

Without the console

Surface How
Key management CLI No command
Admin SDK Not available
API GET /api/v3/admin/tenants/{tenantId}/compliance-remediation/{packId} (operation getComplianceRemediationPlan); GET …/actions/{actionKey}/preview?step=… (operation previewComplianceRemediationAction); POST …/actions/{actionKey}/executions with an Idempotency-Key header (operation executeComplianceRemediationAction); PATCH …/actions/{actionKey} (operation updateComplianceRemediationAction); GET …/executions (operation listComplianceRemediationExecutions); POST …/attestations (operation createComplianceAttestation); GET …/attestations (operation listComplianceAttestations)