Pentest results are not tracked to closure
Description
The penetration test report lists its points with a severity and a recommendation, but the company had no register in which each point was followed until it was closed. Points from the report were discussed in meetings and then drifted. The tester noted that earlier points could not be traced to a fix. Without a single place to track the results, a serious point can stay open without anyone noticing.
Summary
On trackThis workflow is complete.
The report was handled as a document and not as a list of Tasks. The remediation plan lived in the meeting minutes only.
Every point of the penetration test report is now a Finding with an owner and a due date, and the monthly ISMS meeting reviews the open ones.
All points of the report were closed with evidence, and a retest by the tester confirmed the fixes. The corrective action is effective.