Part of Data Security Standard 9 - IT protection
Remediation post-testing (9.2.3)
Any test results will show a number of vulnerabilities. Critical or high-risk vulnerabilities should be remediated within 14 days.
Where they cannot be remediated within the 14 days the risk should be documented, understood, and agreed with your Senior Information Risk Owner (SIRO).
If the remediation has dependencies that will take longer to fix, such as a legacy system requiring replacement, this should form an action in your data security improvement plan.
Remediation post testing
Any test results will show a number of vulnerabilities. Critical or high-risk vulnerabilities should be remediated within 14 days.
Where they cannot be remediated within the 14 days the risk should be documented, understood, and agreed with your SIRO.
If the remediation has dependencies that will take longer to fix (such as a legacy system requiring replacement) this should form an action in your data security improvement plan.
Last edited: 8 October 2025 2:32 pm