Security audits (such as pentests, architecture reviews, and compliance checks) are essential for identifying vulnerabilities and areas for improvement in any information system. But detecting issues is only part of the challenge — you also need to centralize findings, manage remediation actions, and track progress over time. This is exactly what Tenacy enables, with a structured approach built around: Gap Registers, Action Plans, and Monitoring Dashboards.
Create a Gap Register
Every audit can be formalized in Tenacy using a gap register, which centralizes all findings and their remediation process.
🔎 For a detailed guide on setting up your register (adding entries, assigning users, linking action plans, etc.), please refer to this article on non-conformity management in Tenacy (link to be inserted).
Use Case: Pentest Audit
Let’s say a pentest conducted on your web platform reveals several vulnerabilities:
Misconfigured TLS
A cross-site scripting (XSS) flaw
Improper password storage
You create a gap register titled “Pentest Audit – May 2025”, and assign your SecOps team as owner.
💡 You can immediately link an action plan to this register to document all remediation measures (see Step 2).
Step 1.1 – Add and Qualify the Gaps
From the register, create each identified gap by specifying:
A clear description
The impacted perimeter (e.g., web app, infrastructure, endpoints)
The severity/criticality
Optionally, a gap group for better reporting (e.g., “Critical Vulnerabilities”, “GDPR Non-Compliance”)
Step 1.2 – Link Gaps to Your Policy Measures
Within each gap, you can associate relevant security policy measures (e.g., “strong authentication”, “application security”).
👉 This helps assess the impact on your overall compliance, and clearly demonstrates where improvements are being made.
Create and Link an Action Plan
To address and track remediation efforts, create an action plan register from the Action Plans tab. You can then link each action directly to its related gap from the “Actions” tab within the gap view.
Examples of remediation actions:
Fix the vulnerable script
Enforce TLS 1.2+
Implement salted password hashing on the backend
💡 This ensures full traceability between identified issues and corrective actions.
Once actions are linked, you’ll find them under the Action Plan tab, where you can group and organize them as needed.
Monitor with a Custom Dashboard
To track the progress of gap remediation, create a custom dashboard with the following features:
Visibility: Public (for extended project teams) or private (e.g., only for the CISO)
Time window: Allows you to view historical data (e.g., past 6 months)
Organization: Structured into sections (e.g., audits, critical gaps) and blocks (e.g., remediation rates, open vs. closed gaps)
🔎 You can refer to this article to learn how to build dashboards for audit and gaps tracking.