A remediation plan you can copy Track every finding in one table so nothing drops. This is the kind of record an auditor or a customer’s security team expects to see as evidence of a remediation process:

Field Example Finding ID VULN-014 Description Unauthenticated RCE in perimeter appliance (CVE listed on KEV) Priority Emergency Asset and exposure edge-gw-01, internet-facing Owner Network team Response Remediate (vendor patch) Due date Within 72 hours of report Status Fixed Verified Yes, confirmed on retest (date recorded) Evidence Retest screenshot, version confirmed The two rows that matter most are Verified and Evidence. Without them, the plan records intentions, not outcomes. Our vulnerability assessment report template has a longer version with a worked example, and the penetration testing report template shows how the retest results attach to the original findings.