CIS Control 18.3: Remediate Penetration Test Findings

What this means

This control mandates that your organization establish and follow a defined policy for remediating penetration test findings. Rather than ad-hoc responses, you need documented criteria for determining which findings to address, in what order, and by when. The policy should account for severity, business impact, remediation cost, and resource availability to create a realistic remediation roadmap that gets executed.

How to comply

1. 1.Develop a documented penetration test remediation policy that defines scope, prioritization criteria, and timelines
2. 2.Establish severity ratings and map them to remediation deadlines (e.g., critical findings within 30 days)
3. 3.Conduct regular penetration tests and document all findings with supporting evidence
4. 4.Assign ownership for each finding and track remediation status in a centralized system
5. 5.Implement compensating controls for findings that cannot be immediately remediated
6. 6.Validate that remediation efforts actually eliminated the vulnerability through re-testing
7. 7.Report on remediation metrics to leadership and audit teams quarterly

Evidence auditors look for

• Penetration test policy document with defined remediation scope and prioritization framework
• Penetration test reports with findings categorized by severity level
• Remediation tracking spreadsheet or system showing status, owner, and due dates
• Evidence of re-testing to confirm vulnerabilities were eliminated
• Documented exceptions or compensating controls for unresolved findings
• Executive remediation status reports showing trend analysis over time

Frequently asked questions

GRCWatch automates penetration test finding tracking with severity-based workflows, remediation status dashboards, and built-in re-test validation—eliminating spreadsheets and ensuring findings don't slip through the cracks.

See how GRCWatch handles this control automatically

Related controls