Fix validation

Overview

When an engineer says a finding is fixed, PENOPS re-tests it against the live asset. A passing validation is the proof that lets the card close. If a later scan finds the same issue again, PENOPS reopens the card on its own.

Starting a fix validation needs Write on Operations > Validate Fix, Operations > Remediation Delivery or Operations > Risk Treatment.

Validate a fix

1. Open a card in To Do, In Progress or Done on Remediation Delivery.
2. Under Remediation, tick every step. Validate fix is available once all steps are ticked.
3. Click Validate fix. The strip shows Queued, then Scanning. A long run shows Still running with Check again.
4. Read the result. On Fix verified, drag the card to Done.

Clicking Validate fix again while a run is in progress joins that run rather than starting another.

When a fix can be validated

• The card is in To Do, In Progress or Done, and its treatment routes to delivery.
• The finding is confirmed.
• The asset is still in scope of its engagement.
• Cloud and secrets findings need their integration connected. See Integrations.
• Vendor-hosted apps are not tested.
• No validation has passed yet. After a pass the button is disabled with This fix has already passed validation.

If Block Done until fix validation passes is off, you can close a card without validating. It then shows the Unverified fix badge. Moving a card back to the Risk Treatment board clears its validation.

Reopen and regressions

Automatic re-detection

If a later scan finds a resolved finding again, PENOPS reopens it to triage as a Regression with the reason PENOPS found this finding again after it was validated as fixed. Any passing validation is cleared and the card shows ↩ re-detected. The SLA clock keeps counting from the original detection.

Reopen a finding yourself

1. Open a card in Done or the Risk Register and click Reopen….
2. Enter a Reason (required, up to 1,000 characters).
3. Choose a Recurrence type: Regression, New Detection, Acceptance Lapsed or Scope Change.
4. Click Reopen finding.

The card returns to triage. Its treatment, justification and fix validation are cleared, and its SLA clock restarts. Reopening from Done needs Operations > Remediation Delivery: Write; from the register, Operations > Risk Register: Write.

Suppress a finding

Suppress a finding when PENOPS should stop testing for it, for example a known false positive.

1. Open the card and click the eye-off icon (Suppress - stop PENOPS scanning for this finding).
2. Enter a Reason. It is recorded in the audit trail with your name.
3. Click Suppress finding.

PENOPS scanners skip a suppressed finding, so it is not re-detected. The card itself keeps its place and status, and shows a suppressed badge with who suppressed it and why. To undo, click the icon again. Suppressing needs write on any one of the three boards.