The organization shall develop and document a remediation plan for identified deficiencies. This plan should detail the specific measures to be taken to address and correct the deficiencies, particularly those identified during self-assessment processes.
The remediation plan must be reviewed and endorsed by the organization's management to ensure commitment and resource allocation for its implementation. The measures outlined in the plan should be consistent with the organization's overall risk management framework and applicable risk treatment measures.
If required by relevant regulations (e.g., by DNSC in Romania), the organization should submit the completed remediation plan to the designated authority within 30 days of finalizing the self-assessment.
