📋 GRC compliance for CMMC 2.0, CPCSC, CPA Canada, IIROC…SaaS discovery for data governanceFree enriched web chat widget🚀 Enriched remote support without your laptop

Issues & Remediation

Keep one list of everything that needs fixing, who is responsible for it, who is doing it, when it is due and where it stands.

Where to find it
Compliance (GRC) › Issues & Remediation
Who can use it
Anyone with a GRC role that can view compliance data; creating, editing and generating issues need a role that can edit; sending update requests, commenting and exporting each need the matching GRC permission
Plan
Compliance (GRC) platform
For
Everyone

What the page is for

Issues & Remediation is the register of findings and fixes for your company. Issues can be raised by hand or generated from findings elsewhere in the platform: failing automated checks, "No" answers in your latest assessments, resilience follow-up findings, and people-security red flags such as a leaver whose account is still enabled.

Each issue records who is responsible (your service provider, the client, or both), who is assigned, the due date and status, and keeps a full history. When the service provider takes responsibility ("Us"), a matching task is created on the task board and kept in step with the issue.

Service providers can mark an issue as internal. People who sign in as the client company never see an internal issue, its history or its comments. Client users see a note that they are seeing the items their service provider shares with them.

What you see

The Issues & Remediation page, with the header actions, summary cards, filters, bulk actions, issues table and issue dialog numbered 1 to 6.
The Issues & Remediation page. Numbers match the list below.
  1. Header actions: New issue, Generate from findings and Export.
  2. Summary cards: Open, Overdue, Assigned to me, Waiting on the client and Responsibility not decided. Click a card to filter.
  3. Filters: Search, Status, Priority, Responsible, Category, Source, and Assigned to me, Overdue only and Include closed.
  4. Bulk actions: after selecting rows: Set status..., Assign to..., Responsible..., Priority... and Clear selection.
  5. Issues table: Issue, Priority, Status, Responsible, Assigned to, Due, Source and Updated.
  6. Issue dialog: tabs for Details, History, Comments, Links & ticket and Ask for an update.

How to raise an issue

  1. Select New issue.
  2. Enter a Title and What needs doing, and why it matters.
  3. Choose Priority, Category, Due date and Status.
  4. Under Who is responsible?, choose who owns the fix. Choosing "Us" also creates a task on the task board.
  5. Pick a console user in Assigned to (console user), or type the name and email of a person without a login.
  6. Service providers: turn off Visible to the client for internal notes.
  7. Select Save.

How to generate issues from findings

  1. Select Generate from findings.
  2. Tick the sources to use: Failing automated checks, "No" answers in the latest assessments and, where available, Resilience follow-up findings.
  3. Select Generate. The summary shows how many issues were created, reopened, updated and closed. Issues whose finding has gone away are closed; your own responsibility, assignee, due date and status choices are kept.

How to update an issue's status

  1. Open the issue from the table.
  2. On Details, choose Change status to, add a Note (goes into the history), and select Update.
  3. To change many issues at once, tick them in the table and use the bulk Set status..., Assign to..., Responsible... or Priority... lists.
  1. Open the issue and go to Links & ticket.
  2. Under Control, Risk or Task, type in Search to link... and pick a result. Use Remove link to undo.
  3. To involve the help desk, select Raise a ticket for this issue. Tickets are only raised when you press this; automated findings never open tickets by themselves.

How to ask someone for an update

  1. Open the issue and go to Ask for an update.
  2. Enter their Email and Name, and how many days the link lasts in Link lasts (days).
  3. Add an optional covering note and select Send request.
  4. They receive a one-time link, pick a status and can add a note without logging in. The table shows when each request was Sent, Opened, Answered and when it Expires.

Tips

  • Start with Responsibility not decided so every issue has an owner, then Overdue.
  • Use Comments for discussion; everything is also recorded in History.
  • A new update request to the same person replaces their old link.
  • Export downloads the register as a spreadsheet.

Troubleshooting

  • I can't see an issue my provider mentioned. It may be marked internal, which hides it from people signed in as the client company.
  • "Choose at least one source." Tick at least one finding source before selecting Generate.
  • A finding source says "(not available on this console yet)". That source is not set up for your company, so it can't be used.
  • The buttons are missing. Creating and generating issues need a GRC role that can edit; Export needs a role that can export.

Task guides that use this page

Still need help?

Search the support centre, or contact our support team and tell us which page you were on.

Names, companies, devices and figures in the pictures are examples. Other product and company names are trademarks of their respective owners.

We use privacy-friendly, cookieless analytics to count visits, and one cookie to run our live chat. Both load only if you accept. We do not use advertising trackers, and we do not profile you across other websites. The essential cookies that keep the site working are always on. See our privacy policy.