After performing a preliminary security assessment, a company should develop a remediation plan for EVERY security gap identified.

• A. True
• B. False
• C. Only for high-risk gaps
• D. Only after approval

Answer: (A)

Turning assessment findings into action is the focus: you should develop a remediation plan for every security gap identified, outlining the steps, owners, and timelines needed to reduce risk. Having a plan for each gap ensures accountability and provides a clear path from discovery to mitigation, even if some gaps will be addressed later or with lower urgency. It also helps prioritize work by letting you attach risk, impact, and feasibility to each item while preserving a complete record of all identified issues.

Why not limit the plan to only high-risk gaps? Lower-risk gaps can evolve or interact with other weaknesses, and documenting plans for all gaps gives a full, auditable view of the security posture and ensures nothing is overlooked. It also supports governance and budgeting by showing what needs to be addressed and when.

Why not wait for approval to start planning? Drafting remediation plans typically happens alongside the approval process. You can propose actions and timelines for management to approve, but delaying plan creation until approval can slow remediation and leave gaps unmanaged in the interim.