Task completion is an input to closure, not proof of closure. Use this checklist as a review aid and tailor the depth of validation to the risk and change involved.
Before implementation
Define the insecure condition and expected result in observable terms.
- Affected scope and business context are recorded
- Treatment and rationale are approved
- Evidence and retest criteria are defined
- Implementer and verifier responsibilities are clear
At verification
Evaluate evidence from the changed environment and confirm the review covers the relevant scope and period.
- Change is present in the intended environment
- Evidence is attributable and current
- Negative or boundary cases were considered
- Residual exposure is recorded
- Failed validation reopens the work
At closure
Preserve the verifier, decision date, evidence, remaining risk, approvals, and next review trigger in the durable record.
Related resources
Original educational material. Adapt it to your environment and obtain qualified legal, audit, privacy, or security advice where appropriate.