Closure is the most rushed step of a case. Five questions stop the same finding coming back three months later.
As the case queue grows, closures speed up. Faster closures mean the same finding reopens soon after. These five questions largely prevent that.
The questions
- What is the root cause? Is the finding a symptom or the cause itself? A dangling subdomain is a symptom; the cause is a decommissioning process with no DNS step.
- How many other assets share that cause? Fixing one record and closing reproduces the same mistake tomorrow.
- Was it verified? "Fixed" is a claim; a re-scan is evidence.
- Was persistence swept? On credential cases, closure is incomplete without checking sessions, OAuth grants, mail rules and API keys.
- What changed in detection? If the case exposed a gap, the rule or log source that closes it is also an output of this case.
The closure note
The answers to those five questions are the closure note. No note, no closure — the record has merely left the queue.
