Direct answer
When a finding returns, first verify that the new observation concerns the same asset and condition. Compare effective state, deployment history and policy sources, then investigate why the earlier fix did not persist or whether the new result reflects a collection difference.
Compare the observations
Record asset identity, timestamps, scanner version, permissions and observed values for both findings. A hostname reused for a rebuilt device or a stale report may represent a different situation from a configuration reversal.
Reference: NIST SP 800-137: Information Security Continuous Monitoring.
Trace the change
Ask the owner about deployments, policy refreshes, rollbacks, device replacement and exceptions. A local firewall change can be overwritten by centrally managed policy, while an application dependency can return through a later build. Preserve evidence before changing state.
- Identify the source of the effective setting.
- Check version and deployment history.
- Mark incomplete or conflicting evidence explicitly.
Address the underlying process
Fix the condition through its owning management system and add a regression or configuration check where appropriate. For a dependency, confirm the lockfile and release process prevent reintroduction. Coordinate with the service owner and test required workflows.
Reference: NIST SP 800-40 Rev. 4: Enterprise Patch Management Planning.
Verify and monitor
Repeat the original check and positive control after deployment and policy refresh. Set a follow-up review to see whether the setting persists. Keep the original, fixed and recurrent observations rather than overwriting the timeline.
Assessment limits
A repeated scanner alert can reflect real drift, incomplete remediation or collection differences. The cause requires evidence from the actual environment.
Frequently asked questions
Does recurrence prove the first retest was wrong?
No. The state may have changed later, or collection may differ. Compare evidence and deployment history.
Is clearing the latest alert enough?
Investigate why it returned and verify the effective state after the relevant policy or release cycle.
Primary sources and further reading
These guides combine published security guidance with practical assessment planning. Adapt checks to the owner's policy, environment, and authorized scope.
This guide was prepared with AI assistance using the linked sources and illustrative examples. Check current vendor guidance and your environment before making changes.