The Risk Remediation Plan (RRP) provides details for each risk vector to support your remediation work. Each risk vector has its own section in the RRP, and each section lists the findings for that risk vector.
This article describes the RRP details that each section reports.
What is a Risk Remediation Plan (RRP)?
The Risk Remediation Plan (RRP) is a set of details for each risk vector. For each finding, the RRP shows its grade, the dates it was observed, and the group of findings that must be fixed to reach the next grade. The RRP covers the following seven risk vectors.
| Risk vector | What the section reports |
|---|---|
| TLS/SSL Certificates | Issues in your TLS/SSL certificates, such as expired certificates, self-signed certificates, insecure signature algorithms, and large numbers of DNS names |
| TLS/SSL Configurations | Issues in your TLS/SSL configurations, such as insecure protocols and missing or non-standard certificates |
| Web Application Security | Assessment results for components with known vulnerabilities, broken authentication and access control, sensitive data exposure, cross-site scripting prevention, and security misconfigurations |
| Critical Vulnerability Management | Remediation scenarios that project how fixing groups of unpatched vulnerabilities would change your grade over 90 days |
| Desktop Software | Operating systems and browsers on desktop devices in your network that access the internet, with each one marked as supported or unsupported |
| Mobile Software | Operating systems and browsers on mobile devices in your network that access the internet, with each one marked as supported or unsupported |
| DMARC | Checks whether emails sent from your domains pass authentication. |
What details does the TLS/SSL Certificates section show?
The TLS/SSL Certificates section lists issues in your TLS/SSL certificates. Potential findings include expired certificates, self-signed certificates, insecure signature algorithms, and large numbers of DNS (Domain Name System) names.
| Field | What it shows |
|---|---|
| Certificate Serial Number | The unique identifier of the certificate with issues. Use this value to identify TLS/SSL Certificate findings. |
| Last seen date | The date the finding was most recently observed. |
| Finding Grade | The grade of the finding as of the date the RRP was generated: Bad, Warn, Fair, Good
|
| Finding Identifier | The asset (e.g., IP, domain, host, application, port) and its status (e.g. online/offline, version, support status) that identifies the finding. This is not applicable to TLS/SSL Certificate findings. Refer to the Certificate Serial Number to identify TLS/SSL Certificate findings. |
| Grade group | The findings that must be fixed to move from one grade to the next, as of the date the RRP was generated. |
| Issues | The open issues that affect the finding grade. |
Related articles:
- TLS/SSL Certificates Risk Vector
- How is the TLS/SSL Certificates Risk Vector Assessed?
- TLS/SSL Certificate Findings
- TLS/SSL Finding Remediation & Remediation Verification
What details does the TLS/SSL Configurations section show?
The TLS/SSL Configurations section lists issues in your TLS/SSL (Transport Layer Security and Secure Sockets Layer) configurations. Potential findings include insecure protocols, missing or non-standard certificates, and other configuration issues.
| Field | What it shows |
|---|---|
| Last seen date | The date the finding was most recently observed. |
| Finding Grade | The grade of the finding as of the date the RRP was generated: Bad, Warn, Fair, Good
|
| Finding Identifier | The asset, such as an IP (Internet Protocol) address, domain, host, application, or port, and its status, such as online or offline, version, or support status. This field identifies the finding. |
| Grade group | The findings that must be fixed to move from one grade to the next, as of the date the RRP was generated. |
| Issues | The open issues that affect the finding grade. |
Related articles:
- TLS/SSL Configurations Risk Vector
- How is the TLS/SSL Configurations Risk Vector Assessed?
- TLS/SSL Configuration Findings
- TLS/SSL Finding Remediation & Remediation Verification
What details does the Web Application Security section show?
The Web Application Security section reports the results of multiple assessments of your web applications. The assessments cover components with known vulnerabilities, broken authentication and access control, sensitive data exposure, cross-site scripting prevention mechanisms, and security misconfigurations.
| Field | What it shows |
|---|---|
| First seen date | The date the finding was first observed. |
| Last seen date | The date the finding was most recently observed. |
| Evidence Key | The asset, shown as domain:port, associated with the finding to remediate. |
| Failed Evidence Count | The number of failed evidence items associated with the finding. |
| Finding Grade | The grade of the finding as of the date the RRP was generated: Bad, Warn, Fair, Neutral, Good. |
| Total Evidence Count | The total number of evidence items associated with the finding. |
| Web App Security Test | The name of the web application security test. |
Related articles:
- Web Application Security Risk Vector
- How is the Web Application Security Risk Vector Assessed?
- Web Application Security Findings
What details does the Critical Vulnerability Management section show?
The Critical Vulnerability Management Risk Remediation Plan (RRP) is available in two formats: a downloadable .csv or PDF and an interactive report within the Bitsight platform. Both formats list remediation scenarios, group vulnerabilities by severity and duration, and project your future Critical Vulnerability Management grade for each scenario. The PDF also includes a Total findings remediated today column, which is cumulative across the scenarios and is not available in the platform view.
The RRP assumes that only a subset of unremediated findings is fixed when it calculates the projected grade. Remediated findings continue to affect your grade over time. Grades for this risk vector improve slowly because of its long lifetime. The RRP shows how remediating the highest-impact Critical Vulnerability Management findings today would affect your grade over the 90-day lifetime of the risk vector. This projection assumes that all findings in a scenario are remediated and that no new findings are observed.
| Field | What it shows |
|---|---|
| Finding Identifier | The numerical ID of the finding. |
| Vulnerability Severity | The Bitsight severity of the vulnerabilities associated with the findings. Groups are sorted from top to bottom by severity. Learn more about vulnerability severity. |
| Vulnerability | The flaw or weakness in a system’s design, implementation, or operation and management that could be exploited to violate the system’s security policy. |
| Duration | The time a vulnerability was seen unpatched. Duration ranges are based on quartiles, so each range contains a similar number of findings across all severities. |
| Last seen date | The date the vulnerability was most recently observed. |
| Projected grade at 1 day | The projected grade improvement if the scenario criteria are met within 1 day. |
| Projected grade at 30 days | The projected grade improvement if the scenario criteria are met within 30 days. |
| Projected grade at 60 days | The projected grade improvement if the scenario criteria are met within 60 days. |
| Projected grade at 91 days | The projected grade improvement if the scenario criteria are met within 91 days. [Confirm whether this should be 90 days, as stated elsewhere in this article.] |
What details does the Desktop Software section show?
The Desktop Software section lists operating systems and browsers on desktop devices in your network that access the internet. Each one is marked as supported or unsupported.
| Field | What it shows |
|---|---|
| First seen date | The date the finding was first observed. |
| Last seen date | The date the finding was most recently observed. |
| Details | Whether the operating system and browser are supported or unsupported. |
| Finding Grade | The grade of the finding as of the date the RRP was generated: Bad, Warn, Fair, Good. |
| Geo location | The geographic location where the unsupported operating system or browser was observed. |
| Grade group | The findings that must be fixed to move from one grade to the next, as of the date the RRP was generated. |
| Observed devices | The number of observed devices that use the operating system and browser. |
| OS/Browser | The operating system and browser for the finding, with version numbers. |
| Sample IPs | A sample of the hosts that use the operating system and browser. |
Related articles:
What details does the Mobile Software section show?
The Mobile Software section lists operating systems and browsers on mobile devices in your network that access the internet. Each one is marked as supported or unsupported.
| Field | What it shows |
|---|---|
| First seen date | The date the finding was first observed. |
| Last seen date | The date the finding was most recently observed. |
| Details | Whether the operating system and browser are supported or unsupported. |
| Finding Grade | The grade of the finding as of the date the RRP was generated: Bad, Warn, Fair, Good
|
| Geo location | The geographic location where the unsupported operating system or browser was observed. |
| Grade group | The findings that must be fixed to move from one grade to the next, as of the date the RRP was generated. |
| Observed devices | The number of observed devices that use the operating system and browser. |
| OS/Browser | The operating system and browser for the finding, with version numbers. |
| Sample IPs | A sample of the hosts that use the operating system and browser. |
Related articles:
What details does the DMARC section show?
The DMARC section shows the policy for your domain and the findings that affect the DMARC grade.
| Field | What it shows |
|---|---|
| Finding Identifier | The asset and its status, which identify the finding. |
| First seen date | The date the finding was first observed. |
| Last seen date | The date the finding was most recently observed. |
| Finding Grade | The grade of the finding as of the date the RRP was generated: Bad, Warn, Fair, or Good. |
| Policy | How email receivers handle emails that fail authentication. [List the policy values the product displays.] A policy of none allows all emails to pass through. |
| Percentage | The percentage of emails that the policy applies to. |
| RUA Report Email | The mailbox that receives aggregate statistics about authentication failures. RUA stands for “aggregate report URI.” |
| RUF Report Email | A second list of report recipients. Few domains use this field. Organizations use it to request detailed forensic authentication reports. RUF stands for “forensic report URI.” |
| Details | The issues that affect the finding grade. |
- November 2, 2026: Readded tables in each section to make details easier to find and understand.
- April 8, 2025: Risk Remediation Plan available for Web Application Security.
- July 10, 2024: The Critical Vulnerability Management lifetime is 90 days.
- May 29, 2024: Certificate Serial Number replaces Finding Identifier as the TLS/SSL Certificates finding identifier.
Comments
Please sign in to leave a comment.