# Remediation Roadmap

## Prioritization Model

Priority is based on severity, exploitability, exposed data, business process impact, internet exposure, and whether a finding enables another attack path.

| Priority | Finding | Recommended Action | Owner | Timeline | Dependency |
|---:|---|---|---|---|---|
| 1 | [F-XXX] | [Action] | [Owner] | 0-7 days | [None/F-YYY] |

## Immediate Actions: 0-7 Days

- [ ] Contain exposed systems or disable risky functionality.
- [ ] Rotate exposed credentials and invalidate affected sessions.
- [ ] Apply tactical configuration fixes for critical findings.

## Short-Term Actions: 8-30 Days

- [ ] Patch vulnerable components.
- [ ] Add server-side authorization checks.
- [ ] Harden identity, MFA, logging, and alerting controls.

## Long-Term Actions: 31-90 Days

- [ ] Add secure design review gates.
- [ ] Improve asset inventory and attack surface monitoring.
- [ ] Add regression tests for fixed vulnerability classes.

## Validation

Each remediation item should be retested and linked to closure evidence in `_rtexit-output/docs/evidence/`.
