Cloud remediation closure record

Fill in this page, then save a filled copy. Notes stay in this page and are not sent to Cotton. Closing without saving loses your changes.

Use “Save filled copy” to keep an editable HTML file.

For a public-access change, keep the finding open until required security and service checks pass with current evidence. Record the decision, its limits, and what would require reopening it.

Finding / asset / environmentOwner / reviewer / dateBusiness impact and required service behaviorExposure and working service baseline evidenceApproved action, revision, expiry, and preconditionsExecution receipt and observed target stateSecurity retest: identity, method, time, result, evidenceService check: identity, method, time, result, evidenceEvidence source, collector, and separation from executorUnresolved risk, evidence gaps, and coverage limitsDecision and reason: close, open, or inconclusiveReopen trigger, next action, and responsible owner

This record covers one finding and its tested paths. Define acceptance criteria for the actual change. Failed checks or missing required evidence keep the case open. A policy diff or successful API response alone cannot establish closure.

Reference: AWS, Reviewing bucket access with IAM Access Analyzer. Read the AWS guidance.