After Action
Get a Demo

Gap Remediation Plan

Prioritized remediation roadmap with gap tracking, ownership assignment, timeline targets, compliance framework coverage, and progress monitoring.

The Gap Remediation Plan transforms exercise-identified gaps into a structured, trackable remediation roadmap. It assigns ownership, sets timelines, maps to compliance frameworks, and monitors progress through the gap tracker.

Plan Structure

Gap Inventory

All gaps identified during the exercise are compiled with:

| Field | Description | |---|---| | Gap ID | Unique identifier for tracking | | Title | Concise description of the weakness | | Category | NIST 800-61 phase (detection, escalation, containment, etc.) | | Severity | Critical, High, Medium, or Low | | Status | Open, In Progress, or Remediated | | Source | Exercise and inject that exposed the gap |

Prioritization

Gaps are prioritized using a matrix of severity and business impact:

  • Priority 1 — Critical and high-severity gaps with direct regulatory or business continuity impact
  • Priority 2 — Medium-severity gaps affecting response effectiveness
  • Priority 3 — Low-severity gaps representing improvement opportunities

Remediation Actions

Each gap has one or more remediation actions with:

  • Description — What needs to be done
  • Owner — Person or team responsible
  • Target date — When the remediation should be complete
  • Effort estimate — Low, Medium, or High
  • Dependencies — Other actions that must complete first
  • Verification criteria — How completion will be validated

Timeline View

A Gantt-style timeline showing remediation actions across a 30, 60, or 90-day window. Actions are color-coded by priority and show dependencies between items.

Compliance Coverage

Each gap is mapped to the compliance framework controls it affects. The plan shows:

  • Which SOC 2 trust service criteria are impacted
  • Which NIST CSF subcategories need attention
  • ISO 27001, HIPAA, or PCI-DSS controls at risk
  • Aggregate framework coverage percentage before and after remediation

Gap Tracker

The Gap Tracker in the Ops and Client portals provides ongoing monitoring:

  • Real-time status updates as gaps move through remediation
  • Overdue gap alerts when target dates pass
  • Framework coverage metrics that update as gaps are remediated
  • Progress charts showing remediation velocity

Remediation Tickets

Gaps can be converted to remediation tickets with assigned owners and SLA targets. Tickets support status transitions (open, in progress, remediated) and maintain an audit trail of all changes.

Export

The Gap Remediation Plan exports as PDF with the full gap inventory, timeline, and compliance mapping. It serves as both a working document for the security team and an evidence artifact for compliance auditors.