Remediations and retests

A remediation is the fix work for one finding. A retest asks TrekShield to confirm that fixes work. Deadlines are explained in SLA and remediation.

Assign a fix

A Client Administrator opens a Reported finding and chooses Assign Remediation, then picks a Client Developer or Client Administrator from the same company and sets a due date. Start Fix assigns the finding to yourself instead. The finding moves to In remediation as soon as the remediation exists. Reassign later from the remediation page.

Work the fix

Step	Who	Requirement
Acknowledge	Assignee	None
Start Work	Assignee	None
Submit Fix	Assignee	Description of at least 10 characters
Verify Fix	TrekShield pentester	Retest notes of at least 10 characters
Reject Fix	TrekShield pentester	Reason of at least 10 characters

Client Administrators can perform assignee steps on a developer’s behalf. Developers and administrators can also mark a remediation Blocked with a reason of at least 10 characters, which pauses its SLA clock; Resume continues it. A developer cannot block after submitting a fix. A rejected fix returns to In progress; after three rejections it is escalated to an engagement manager. Add notes on the remediation page for context.

To accept risk instead, a Client Administrator can do so on the remediation for medium, low and info findings with a reason of at least 50 characters. Critical and high findings need the approval workflow.

Request a retest

Retests are available once the engagement is Delivered or Completed, or on hold.

1. A Client Administrator selects Request Retest on a finding that is In remediation, or selects several findings on the engagement’s Findings tab.
2. The retest starts as Requested. A TrekShield engagement manager schedules it and assigns a pentester.
3. The pentester records a result per finding: Verified, Still vulnerable or Partially fixed. A retest cannot complete while any result is Pending.

You are notified when a retest is scheduled and when it completes. You can cancel a retest only while it is Requested.

What a retest changes

• Verified: the finding becomes Verified and its active remediations are closed as verified.
• Still vulnerable or partially fixed: the finding stays In remediation and active remediations reopen to In progress.

Included retests

Each retest is numbered within its engagement. It is flagged billable when its number exceeds the retests included with the engagement; if no limit is set, none are billable. Your engagement agreement sets what is included.