# Default Remediation Plan Values
# These values are used when creating new remediation entries for discovered findings

defaults:
  new_finding:
    status: "new"
    planned_action: "Under evaluation"
    target_date: null
    assigned_to: "security-team"
    notes: "Newly discovered - assessment in progress"
    workaround: "None identified"
    priority: "medium"
    business_impact: "Under assessment"

# Status definitions and workflows
status_definitions:
  new:
    description: "Newly discovered finding requiring initial assessment"
    next_states: ["in_progress", "awaiting_upstream", "accepted_risk"]
    
  in_progress:
    description: "Actively working on remediation"
    next_states: ["completed", "blocked", "awaiting_upstream"]
    
  awaiting_upstream:
    description: "Waiting for upstream fix or vendor response"
    next_states: ["in_progress", "completed", "accepted_risk"]
    
  blocked:
    description: "Remediation blocked by external factors"
    next_states: ["in_progress", "accepted_risk"]
    
  accepted_risk:
    description: "Risk accepted, no remediation planned"
    next_states: ["in_progress"]  # Can reopen if needed
    
  completed:
    description: "Remediation completed and verified"
    next_states: []  # Terminal state

# Priority levels and SLA targets
priority_sla:
  critical:
    target_days: 1
    escalation_days: 2
    
  high:
    target_days: 7
    escalation_days: 14
    
  medium:
    target_days: 30
    escalation_days: 45
    
  low:
    target_days: 90
    escalation_days: 120

# Default assignments by severity
severity_assignments:
  critical: "security-team"
  high: "security-team"
  medium: "dev-team"
  low: "dev-team"
  info: "dev-team"

# Common remediation actions templates
action_templates:
  upgrade_package: "Upgrade {package} from {current_version} to {target_version}"
  replace_package: "Replace {package} with alternative: {alternative}"
  configuration_change: "Update configuration to mitigate {vulnerability_type}"
  code_review: "Review and update code to address {finding_type}"
  monitoring: "Implement monitoring for {security_concern}"