Remediation plans should cover every security gap identified.

• A. True
• B. False
• C. Only if approved by management
• D. Only for high-severity gaps

Answer: (A)

Addressing all gaps identified in a security assessment creates a clear, accountable path to reduce risk. A remediation plan isn’t just about fixing the most obvious problems; it maps every identified gap to a concrete action, assigns an owner, sets a timeline, and defines how the fix will be validated. This completeness matters because leaving gaps untracked or unaddressed leaves risk lurking, undermines audits, and makes governance harder. Even when some gaps are lower risk or require more resources, the plan should still document them with appropriate prioritization, rationale for any delay, and, if necessary, formal risk acceptance. That way, progress is measurable, and nothing slips through the cracks. Reckoning only the high-severity issues or needing management approval for every item would create gaps in coverage and slow down risk reduction, which is why a plan covering every identified gap is the best approach.