Remediations
The Remediations section tracks the work required to address identified risks. Every remediation task is linked to a parent risk in the Risk Register and provides assignment, due date tracking, and status progression.
Creating Remediation Tasks from Risks
Remediation tasks can be created in two ways:
From the Risk Register: Open a risk detail panel. Click Add Remediation Task. The task is pre-populated with the risk title and score context.
From the Remediations section: Click Add Task, then search for and select the parent risk to link it to.
Each remediation task includes:
- Title — a specific, actionable description of the work to be done
- Parent Risk — the risk this task addresses (required)
- Owner — the person responsible for completing the task; must be a workspace member
- Due Date — the target completion date
- Priority — High, Medium, or Low (defaults to match the parent risk's score)
- Description — additional context, instructions, or links to runbooks
- Status — current progress status
Tracking Progress
Remediation tasks move through three status values:
| Status | Description |
|---|---|
| Open | Task created but work has not started |
| In Progress | Work is actively underway |
| Completed | Work is finished; the risk has been addressed |
When all remediation tasks linked to a risk are marked Completed, CMDash prompts you to update the parent risk's status to Closed (if fully remediated) or to document any residual risk.
Owners of remediation tasks receive email notifications when:
- A task is assigned to them
- A task's due date is within 7 days
- A task's due date passes without being marked Completed
Notification thresholds are configurable in the Notifications section.
Send to Jira
Send to Jira [Essentials+] turns a remediation task into a Jira issue. The button appears
on the Remediations page and beside the open task in a control's How to fix block (see
Compliance Frameworks). It needs a connected Jira
integration and is available to OWNER and ADMIN members; a workspace whose plan does not include
it sees a plan note in the button's place.
- Click Send to Jira. The dialog shows whether dry-run is on.
- Dry-run is on by default. Preview push (dry run) renders the exact issue (project, type, priority, labels, summary and description) and sends nothing to Jira.
- To create real issues, an owner or admin turns dry-run off in the dialog's first-push step, after a confirmation. The change is written to the audit log. Anyone else is told to ask an owner or admin, and can still preview.
- With dry-run off, Prepare push shows the payload and Confirm real push creates the issue. Every push waits for that confirmation.
- The task then links to the created issue, and pushing the same task again returns that issue instead of creating a duplicate.
POA&M Export
The Remediations section includes a dedicated POA&M Export function [Starter+]. This generates a structured export compatible with CMMC and FedRAMP assessor requirements.
To generate a POA&M:
- Navigate to Remediations and click Export POA&M.
- Select the scope: framework (CMMC or FedRAMP), status filter (e.g., Open and In Progress only), and date range.
- Select the output format: XLSX or CSV.
- Click Generate. The file downloads immediately.
The exported POA&M follows the standard column structure including Control ID, Weakness, Scheduled Completion Date, Milestones, and Resources Required.