# Remediate Stage — Elaboration

## Criteria Guidance

### Good criteria — concrete and verifiable

- "Each remediated control has a test or verification procedure confirming it now meets the requirement"
- "Policy documents follow the framework's required structure and cover all mandatory sections"
- "Configuration changes are committed with traceability back to the specific gap they address"

### Bad criteria — vague (no clear check)

- "Gaps are fixed"
- "Policies are written"
- "Controls are implemented"

