Remediation loop

What is remediation loop?

The remediation loop moves a cryptographic finding from detection through ownership, change execution, verification and durable closure.

The assessed field clusters on discovery. The largest practical separation often appears after a finding exists: ticket state, certificate deployment, exception handling and closure verification.

Questions to ask a vendor

1. Is integration one-way or bidirectional?
2. Has the complete loop run against a live tenant?
3. Can the system reopen a closed item when the underlying exposure remains?

What this edition actually supports

Weight 2 of 19. Can a finding reach an owner, a controlled change and a verified closure?

Recommendations, ticket creation, human action and confirmed closure are different steps. QScout scores 6 here; DigiCert Quantum Central scores 8 in the frozen record. QScout's owned loopback lab demonstrated one verified closed ticket and four nonclosed controls with harness-supplied rescan flags; it was not a customer ticketing tenant or autonomous remediation. NIST describes crypto agility as changing algorithms while preserving security and operations.

How to investigate this criterion

Trace the exact finding, owner, approval, action, rescan and reopened-state rule; ask who performed each step.

Primary and original inputs: pqc-index.org · pqc-index.org · csrc.nist.gov. Review all dated cell source checks and the 1 October per-cell limits.

The 2026.7 cells below are public-evidence scores. A vendor page documents a claim; an artifact check tests only its stated scope. Missing product execution and inaccessible sources remain explicit unknowns. The score snapshot has not been recomputed from later pages.