4. Remediation doctrine

Remediation corrects a failed condition through verifiable evidence, an approved rule, a governed mapping, valid authority, or another repeatable mechanism. Containment and exception handling can govern the use while correction is incomplete. They do not by themselves close the failed control.

Quarantined may hold candidate evidence during review. Stop prevents prohibited or unauthorized use. Where a failed control’s evidence is permitted for bounded use, Caution requires a valid authorizing exception with the required scope, constraints, authority, and expiration or review condition. The failed result stays Fail.

Human review is not automatically non-repeatable. When a human adjudication is material, the adjudication should become governed evidence: for example, a versioned mapping, approved tie-break rule, exception record, classification decision, or authoritative disposition that can be applied or inspected again.

Close a failed finding only after the control is retested and the new evidence-backed result is recorded. If a new recorded Applicability Rule establishes Not Applicable, preserve its reason and supporting facts; do not narrow scope merely to conceal a failed mandatory obligation. Create new linked evaluations and Gate or Conformance Records where required. Preserve the original result, evidence, rule versions, and Gate state under the applicable integrity and lawful-retention rules.

Recover historical evidence only from verifiable contemporaneous records. A later approval, changed threshold, current artifact, or new execution does not prove what was authorized or used earlier. A changed rule or scope takes effect prospectively and belongs to a new assessment. These history and closure rules apply to every card.

Failure-to-remediation linkage. Common failure modes are diagnostic clues, not new control results. When a control can fail for different reasons, match each observed failure condition to the corresponding remediation action in the card. If more than one failure condition is present, remediate each affected condition before retest.

Retest scope after remediation. Retest the failed control and any other applicable controls affected by the change. Re-run the full Gate when the remediation changes evidence, meaning, identity, relationships, context, authority, constraints, or another condition that may affect the Gate outcome. A local correction does not require unrelated controls to be rerun.