Finding Lifecycle
To close: Write the Outcome · List the open follow-ons (deep-link expand, occurrence view, rubric versioning) as carried to the governance lab · Move to HISTORY.md
last activity Aug 27
An advisor told us what security teams do with a finding and how fast they must fix it. Our reports assumed that workflow, but nothing in the product did it.
Findings in the product now group under their rule, carry a status and a remediation clock, and can be ignored or accepted as risk with a reason. It shipped within three days.
Documents
With file names, on their own page →What changed
The three changes that matter most, in plain words. Open any one to see it.
- 1
In the product, findings now sit under the rule they break, each with its own status and remediation clock.
The findings page, rebuilt in the product · came from Mark Peterson and Mark Parsonopen →
- 2
Adjudicate opens a card where you can ignore a finding, or accept the risk with a reason and an end date.
Adjudicate: ignore it or accept the risk · came from Mark Peterson and Mark Parsonopen →
- 3
No person can mark a finding fixed; it closes when a re-check shows the problem gone, and its deadline counts from when it was found.
Only evidence closes a finding · came from Mark Peterson and Mark Parsonopen →
- The shared library gained a severity tag, an agent pill with its pixel face, and a quieter way to open a row inside a row. In words
How we got here
Each change, traced back to the conversation it came from. A solid mark means the record names the source; a dashed one was matched by the draft and waits for review.
“a lot of these things are, like, recurring on many resources that are basically the same thing. Fixing it once addresses all of them.”
market-analyst /calls/2100ac03… (local)“the clock starts at that point... I need to let me know right away. Right? The clock is ticking right away. It doesn't start from the moment I triage. It starts from the moment of it's been found.”
market-analyst /calls/2100ac03… (local)c79-D24 Terminology: Control → Finding → Occurrence. — Mark Parson
c79-D11 Repeat occurrences never reset the clock; the first one starts it. — Mark Parson
c79-D26 Status is a dropdown in the findings table while a finding is open, and a plain chip once it is closed. — Mark Parson
In the product, findings now sit under the rule they break, each with its own status and remediation clock.
“I gotta act on this. Right? So what does that look like in this case?... okay. You know, I gotta I gotta act on this... Acknowledge it, and and then keep a record of it.”
market-analyst /calls/2100ac03… (local)c79-D3 Ignore is not an exception: ignore means "not a real finding"; an exception is real risk, formally accepted, with a required expiry. — Mark Parson
c79-D15 The door verb is Adjudicate; disposition is the stored outcome, and resolve is kept for evidence. — Mark Parson
c79-D18 "Accept risk" replaces "exception" as the act; exception stays as the noun. — Mark Parson
Adjudicate opens a card where you can ignore a finding, or accept the risk with a reason and an end date.
“if we have a critical vulnerability finding, for example, remediated 14 days, we have a high, it's 30, A medium, it's 90 days”
market-analyst /calls/2100ac03… (local)c79-D9 The rubric is Mark M's real program: critical 14 days, high 30, medium 90, low advisory with no hard target. — Mark Parson
c79-D16 Two axes, one displayed status: risk state drives the SLA math; handling (acknowledged, escalated, enforced) never touches it. — Mark Parson
No person can mark a finding fixed; it closes when a re-check shows the problem gone, and its deadline counts from when it was found.
Thanks to
People outside Qpoint first. Every thank-you points at something they said or made.
Named the verbs and the clock
On the Aug 20 product review he listed what a team does with a finding (acknowledge, ignore, make an exception, act now or ticket it, keep a record for auditors), gave his program's 14/30/90-day deadlines, and said the clock starts at discovery, not at triage.
“the clock starts at that point... I need to let me know right away. Right? The clock is ticking right away. It doesn't start from the moment I triage. It starts from the moment of it's been found.” first-hand
Designed the adjudication card
Drew the grape adjudication card, the agent pill and the policy header, picked "Adjudicate" as the door verb, and chose status as a dropdown in the findings table.
All images
Every picture from this cycle. Click any one to step through them all.
The pairs
Everything captured · 3
The full record 25 decisions · 22 key-change entries · 5,039 words · 3 captures
The record stays as written, for agents and for audit: Key Changes, every decision, the artifacts and the visual record.
Open the record for c79 →