RV.3.1 Analyze Vulnerabilities to Identify Root Causes
Perform root cause analysis on confirmed vulnerabilities so that systemic weaknesses are identified and remediated, not just individual instances. Feed the lessons back into design, coding, and testing practices.
4
artefacts
2
held by a system
0
at each review
easy
to go live
SIEM / log platform
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Log of systemic improvements driven by RCA · SIEM / log platform
- Metrics on recurrence of similar findings · Policy repository / GRC workspace
periodic reviewEvidence produced at each review
none for this control
governing documentDocuments that govern the control
- Root cause analysis template · Document repository
- Training updates citing RCA outcomes · HR system / LMS
First move
Automate the pull from your SIEM / log platform. Retention and alert rules exported from the SIEM; review evidence is the closed-alert record with reviewer and time.
Common gaps auditors find
- RCA performed only on incidents that draw external attention
- lessons not propagated to other teams
- training and standards never updated based on RCA
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetRV.2.2 Develop and Implement Remediation Plans · RV.3.2 Identify and Fix Similar Vulnerabilities