6. Reusable remediation patterns
Pattern references identify reusable classes of corrective action. They do not change a control result, create a severity level, or replace the control-specific remediation procedure. A control card may cite more than one pattern when different corrective-action classes apply.
| Pattern | Use when |
|---|---|
| R-01 Missing evidence | Retrieve or create the required record for the assessed scope and version, then retest. For a historical finding, recover only verifiable contemporaneous evidence; a new record does not invent the missing past fact. |
| R-02 Ambiguous meaning | Resolve competing definitions or boundaries through the accountable semantic authority. Version the approved meaning and update affected mappings. |
| R-03 Unstable identity or grain | Establish the authoritative identifier or resolution rule, declare semantic grain, add crosswalks/tie-breakers where required, and replay the case. |
| R-04 Missing authority | Identify the accountable business, stewardship, risk, or operational authority. Do not substitute technical ownership or system permission for business authority. |
| R-05 Conflicting evidence | Preserve the conflict, apply an approved precedence/adjudication rule, record the resolution and losing evidence, or assign Stop/Quarantined until resolved. |
| R-06 Threshold or rule failure | Correct the evidence or use, or obtain a valid bounded exception. Any justified threshold or scope change is authorized, versioned, and effective prospectively; create a new assessment and preserve the original result. |
| R-07 Unsupported discovery | Keep candidate evidence Quarantined and route it through the applicable taxonomy, ontology, identity, or AI controls before stated use. |
| R-08 Material change or drift | Identify affected active or prospective scopes, invalidate readiness as defined, reassess applicable controls and Gates before new reliance, and create linked new records. Preserve prior versions and determinations. |
| R-09 Missing execution record | Recover verifiable contemporaneous execution evidence where available. If the historical step cannot be established, retain its failed finding or limitation. A rerun is a new execution, not retrospective proof. Add evidence capture for future use. |
| R-10 Prohibited or out-of-scope use | Stop the prohibited use. Any justified new scope or permitted-use change requires valid competent authority, a prospective version, and new assessment. Do not exclude mandatory obligations to hide failure. An exception supports only the bounded use the authority may lawfully grant. |
| R-11 Human adjudication | Convert the decision into governed evidence: a mapping, resolution rule, classification, exception, authority decision, or other versioned record with effective period and review condition. |
| R-12 Automated or AI-assisted control | Use automation to execute the control only when the rule, context, evidence capture, authority, and consequence are explicit. Automation may evaluate evidence; it does not create authority or self-conformance. |
| R-13 External boundary evidence | When direct inspection is legitimately unavailable, complete the Boundary Evidence Anchor with exact evidence identity, interface/version, time, inaccessible boundary, and scope mapping. Include fingerprints where possible and supporting references where available; attestation alone is insufficient. |
| R-14 Version and integrity hardening | Pin the exact DACS/artifact/rule version and add verifiable integrity evidence before retest. |
| R-15 Prospective rule correction | Correct the governing rule prospectively with authority/effective dating; preserve the prior rule and prior result; create a new evaluation rather than rewriting history. |
| R-16 Runtime fail-closed control | Block material action on enforcement failure or use only a previously authorized bounded degraded mode; never improvise fail-open behavior. |
| R-17 Lawful evidence preservation | Apply the lawful retention/deletion rule and preserve the strongest legally permitted reconstruction anchor; constrain reconstruction claims when the law prevents retention. |
| R-18 Append-only retest history | Create a new linked evaluation event after remediation; preserve prior failures, Gate states, exceptions, and evidence rather than overwriting them. |