Documenting Remediation Decisions

A remediation decision records what you will do about a vulnerability and why. The CRA expects you to document how you handle each vulnerability. Remediation decisions need the Reporting plan or higher.

Record a decision

1. Open the report in Submissions.
2. In the Remediation Decision panel, select a decision:
   • Fix
   • Workaround
   • Accept (accept the risk)
   • Transfer
   • Defer
3. Write the rationale.
4. Optional: set a target date and the person who is responsible.
5. Save.

Each report has one remediation decision. When you save again, the new values replace the old values. CVD Portal writes a REMEDIATION_DECISION_SAVED entry in the audit log for each save.

Verify the fix

After the report status is RESOLVED, you can confirm that the fix works in production. Use Verify fix is holding in production on the report. This needs a Fix or Workaround decision first. CVD Portal records the time and your note.

Thirty days after a report is resolved, CVD Portal sends an email to the company admins to remind them to verify the fix. See Post-Release Tracking.

Limits

• CVD Portal does not link a decision to a release version or a pull request.
• An Accept decision does not need a second sign-off.