Create Risk Reduction Plans
A risk reduction plan in ETM is a prioritization plan that you create in the Risk Workbench. The plan identifies the findings to remediate within a defined scope and shows the projected TruRisk reduction.
Create a Plan
- Go to Risk Management > Risk Workbench and select Start Prioritizing.
- Define the scope. Select one or more business entities, or select Choose Tags Instead to prioritize tagged assets.
- Select a prioritization approach:
- Highest Risk Reduction: Uses the default template to prioritize the findings that provide the greatest reduction in organizational risk.
- Let Me Decide: Builds a custom template from Common, Vulnerability, and Misconfiguration filters.
- Select Prioritize Now. ETM calculates the prioritized findings and the projected TruRisk reduction.
- Review the results, such as the impact cards and Potential TruRisk Reduction.
- Select Save Prioritization Plan, and then enter a name and description.
The saved plan appears on the prioritization listing page on the Risk Workbench tab. For detailed steps, see Prioritization Workflow.
Act on Findings in the Plan
Use the Actions menu or the Quick Actions menu for selected findings:
| Action | Purpose |
|---|---|
| Accept Risk | Accept the business risk. |
| Mark False Positive | Exclude invalid findings. |
| Add Supporting Artifacts | Attach evidence or documentation. |
| Launch TruConfirm Assessment | Validate exploitability. |
Hand Off the Plan for Remediation
If your subscription includes TruRisk Eliminate, save the plan to create an Elimination Plan and manage remediation activities there. You can assign a remediation owner to provide clear accountability. For more information, see Prioritization Workflow With TruRisk Eliminate.
The scope of a prioritization plan is locked when you create it. Assets and findings that are discovered later aren't added to the plan, which keeps progress tracking accurate.
To share the plan, download the Prioritization report from the menu. The report includes the plan title and description, scope and filters, impacted findings, and asset details.