Skip to main content

Documenting Remediation Decisions

A remediation decision records what you will do about a vulnerability and why. The CRA expects you to document how you handle each vulnerability. Remediation decisions need the Reporting plan or higher.

Record a decision​

  1. Open the report in Submissions.
  2. In the Remediation Decision panel, select a decision:
    • Fix
    • Workaround
    • Accept (accept the risk)
    • Transfer
    • Defer
  3. Write the rationale.
  4. Optional: set a target date and the person who is responsible.
  5. Save.

Each report has one remediation decision. When you save again, the new values replace the old values. CVD Portal writes a REMEDIATION_DECISION_SAVED entry in the audit log for each save.

Verify the fix​

When the fix is released, confirm that it works in production. Use Verify fix is holding in production on the report. You can do this before or after you close the report. A Workaround or Defer decision completes the Fix stage only after this verification. CVD Portal records the time and your note.

Thirty days after a report is resolved, CVD Portal sends an email to the company admins to remind them to verify the fix. See Post-Release Tracking.

Limits​

  • CVD Portal does not link a decision to a release version or a pull request.
  • An Accept decision does not need a second sign-off.