Updating Gap Status

Changing a gap's status is how you track remediation progress. This guide covers when and how to update status, including required documentation.

Status Options

Gaps can be in these states:

Status	Color	When to Use
Open	Gray	Gap identified, not yet addressed
In Progress	Blue	Actively being remediated
Resolved	Green	Successfully addressed with evidence
Accepted	Yellow	Risk accepted, won't remediate

Changing Status

Single Gap Update

Open the Gap

Click the gap from the list to open its detail view.

Click the Status Badge

A dropdown menu appears with status options.

Select New Status

Choose the appropriate status from the list.

Add Notes

A modal appears for required documentation. Explain the change.

Save Changes

Click "Update" to apply the new status.

Bulk Status Updates

Update multiple gaps at once:

Select gaps - Check boxes next to gaps in the list
Click "Bulk Actions" - Opens the action menu
Choose "Update Status" - Select the new status
Add notes - Explanation applies to all selected gaps
Confirm - Apply changes

Bulk updates are logged in the audit trail. Be specific in your notes since the same explanation applies to all selected gaps.

Status Transition Rules

Valid Transitions

From	To	When Appropriate
Open	In Progress	Work has started
Open	Resolved	Quick fix, immediately addressed
Open	Accepted	Management approved non-remediation
In Progress	Resolved	Remediation complete
In Progress	Open	Work paused or needs re-evaluation
In Progress	Accepted	Decision made to accept risk
Resolved	Open	Issue reappeared or not fully fixed
Accepted	Open	Risk tolerance changed

Status Reopening

Gaps can be reopened if:

The fix didn't fully address the issue
New evidence shows the gap persists
Related findings from audits
Regulatory changes make previous resolution insufficient

Documentation Requirements

For "In Progress"

Include:

Who is working on this
What workflow or task addresses it
Expected timeline

Example note:

"Assigned to security team. Workflow WF-042 created. Expected completion: 2 weeks."

For "Resolved"

Include:

What was done to fix it
Link to evidence documents
Who verified the fix

Example note:

"Updated Access Control Policy to include quarterly access reviews. See Document DOC-156. Verified by Security Manager."

For "Accepted"

Include:

Business justification
Who approved the acceptance
Compensating controls if any
Review date

Example note:

"Accepted by CISO (Jane Smith) on 2024-01-15. Risk is low due to limited data exposure. Compensating control: enhanced monitoring. Review by Q2 2024."

Acceptance documentation is especially important for audits. Auditors expect clear justification and approval for any gaps not remediated.

Linking Evidence When Resolving

When marking a gap as resolved, link supporting evidence:

Click "Add Evidence"

Opens the document selector.

Choose Documents

Select existing documents or upload new ones.

Explain Relevance

Note how each document addresses the gap.

Complete Resolution

Evidence links are saved with the status change.

Good Evidence Practices

Evidence Type	Example
Policy update	Revised policy document with gap coverage
Procedure	New or updated procedure addressing requirement
Configuration	Screenshot showing implemented control
Test results	Scan or assessment showing remediation
Sign-off	Approval document from management

Status History

Every status change is recorded:

Recorded Data	Purpose
Previous status	Shows what changed
New status	Current state
Who changed it	Accountability
When changed	Timeline tracking
Notes provided	Justification and context