# Remediation Plan The **Remediation plan** tab of the [Workspace](https://wiki.cyberguard.srl/cat/workspace.md) turns the findings of your assessments into a plan: for every **Critical** and **Warning** finding of Active Directory, Microsoft Entra and Microsoft 365 it tracks since when it is open, who is working on it and by when it should be fixed. You don't have to fill it in: CyberGuard builds it from your assessments. A finding enters the plan when an assessment reports it for the first time, and it is **closed automatically** when a newer assessment of the same module (for Active Directory, of the same domain) no longer reports it. If the finding comes back, it is reopened and returns to **To do**. ## Overview  The indicators at the top answer the questions of a security review: - **Open findings** — how many findings are open, split into critical, warning and risk accepted; - **How long they have been open** — the open findings by age, 0-30, 31-60, 61-90 and over 90 days, with the average age; - **Plan** — how many findings are past their target date, how many have an owner and how many are in progress; - **Last 6 months** — the findings opened and closed month by month, and how many were closed in the last 30 days. ## The Plan  The **Open** list shows each finding with its status, module, severity, the date it was first found and how many days it has been open, the target date and the owner. The **Closed** list keeps the findings that have been fixed or for which the risk has been accepted. Filter the list by module, severity, status and owner, or search for a finding, an object or an owner. **Export CSV** downloads the plan, for example to share it with a supplier or attach it to a ticket; **Security Score** opens the findings in the [Security Score](https://wiki.cyberguard.srl/cat/assessment/security-score.md). ## Planning a Finding  Click the pencil of a finding to open its panel on the right: - **Status** — **To do**, **In progress** or **Risk accepted**. Accepting a risk requires an administrator: the target date becomes the expiry of the acceptance and the note its reason; - **Owner** — one of the users of your organization; - **Target date** — pick a date, or set it 30, 60 or 90 days from today with one click; - **What to do** — the recommendation for the finding; - **History and notes** — when the finding was first detected, reopened or seen again in the latest assessment, and the notes of your team. Every change to the plan and every note is also recorded as an activity in the [Workspace](https://wiki.cyberguard.srl/cat/workspace/internal-activities.md), with author and date. The same panel opens from the **Document in the workspace** button of every finding in the [Security Score](https://wiki.cyberguard.srl/cat/assessment/security-score.md), where the **Plan** column shows the owner, how long the finding has been open and its target date — in red when it has passed. The plan is also summarized in the monthly report: how long the main risks have been open and who owns them.