NOTE—03
What a retest can honestly close.
A retest answers a narrow, useful question: did the agreed fix change the observable condition under a sufficiently comparable setup? It is not a second full assessment unless the scope says so.
Define the retest entry condition
Name the original finding and evidence, supplied fix version, environment, accounts, dates, expected behavior, material changes, and anything that cannot be reproduced.
Use explicit current states
Closed, partially remediated, unchanged, regressed, not reproducible, and not tested mean different things. Each status needs current evidence and a limitation note where applicable.
Record residual and adjacent risk
A local fix may close the tested path while leaving the root cause, another role, another endpoint, or a compensating control unverified. Say so plainly and assign the next decision.
Close the finding, not the whole system
The closure letter should state what was retested, when, with what result, and what was outside the retest. It should never declare the whole application, network, or organization ‘secure.’
NEXT DECISION
Turn the principle into a working scope.
The scoping interview creates a structured draft for human review. It does not send messages or proposals automatically.
Scope an engagement