---
sourceDocument: Australia Security Management
sourceDocumentLink: https://www.servicenow.com/docs/r/security-management

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Resolve remediation tasks

# Resolve remediation tasks {#ariaid-title1}

* Release version: Australia
* 
* Updated March 12, 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read

The flexibility inherent in Vulnerability Response allows you to
remediate vulnerabilities in whatever way suits your security organization.

## Before you begin

Role required: sn_vul.vulnerability_admin or sn_vul.admin (deprecated)

## About this task

Once you are notified that a change request is resolved, move the remediation task state to Resolved and wait for the next scan. Rescans are triggered automatically by the third-party import schedule configured in the Setup Assistant.  
Note:  
If state synchronization is activated, remediation tasks are automatically
moved to the Resolved state after a change request associated with a
remediation task (VUL) is implemented and in the Review state. See [Change management for Vulnerability Response](https://www.servicenow.com/docs/rJLLQMfetmDSSTGbuH_CNw "As an IT remediation owner, you can create and manage change requests (CHG) directly from remediation tasks (RT) in the Vulnerability Response application. Change requests help you initiate and track change activities on your assets so that you can remediate your remediation tasks and their corresponding vulnerable items.").

## Procedure

1. Navigate to AllVulnerability ResponseRemediation tasksAssigned to me.
2. Click a record that is in the Open state.  
   The Open state indicates that the record has not yet been worked on. The form displays:
   * Remediation task information
   * Group Configuration details
   * Notes
   * Associated vulnerable items
   * Task SLAs
   * Change Requests
   {#remediate-vuln-groups__ul_vfh_ghr_3v}
3. Perform your analysis of the group.
4. When you are ready to start working on the record, choose any of the following options.

   | Option | Description |
   | If the vulnerable item poses a risk to your IT environment, create a CHG record and escalate the issue to [Change Management](https://www.servicenow.com/docs/access?context=c_ITILChangeManagement&version=australia&pubname=australia-it-service-management&ft:locale=en-US) team. | Assign the group to the appropriate group or individual and click Create Change. |
   | If the vulnerable item poses a potential security risk to your organization, create a security incident record and escalate the issue to the [Security Incident Response](https://www.servicenow.com/docs/30hiWPywiUhVBh06ZQTFDQ "The ServiceNow Security Incident Response application tracks the progress of security incidents from discovery and initial analysis, through containment, eradication, and recovery, and into the final post incident review, knowledge base article creation, and closure.") team. | Click Create Security Incident. This button is displayed only when Security Incident Response is activated. A business impact calculation is applied, the incident is assigned, and the security incident is created. |
   |-|-|

   {#remediate-vuln-groups__choicetable_scx_gm5_b2b}  
   After you create a change request, the appropriate record appears in the Change Requests related list on the Vulnerability Group form.
5. If you determine that the issue is of low risk and can be deferred, click Request Exception.  
   For more information on how to defer a remediation task, see [Defer a Remediation task](https://www.servicenow.com/docs/Lm~gCnNyRhKdRT6AmVlYHQ "If you determine that the issue associated with a remediation task (VUL) is a low priority and can be immediately deferred without further analysis, you can use the Request Exception feature.").
6. If you determine that the issue can be immediately closed without further analysis, click Close.  
   For more information on how to close a remediation task, see [Close a remediation task](https://www.servicenow.com/docs/mZnT1oJCt5HVhKnMPQOGBQ "If you determine that the issue associated with a remediation task can be immediately closed without further analysis, you can use the Close feature. Starting with v23.0 of Vulnerability Response, the Close button has been removed for a remediation task and the closure of a remediation task is driven by the scanner."). Starting with v23.0 of Vulnerability Response, the Close button has been removed for a remediation task.  
   A third-party integration scheduled job automatically updates and scans
   records at a set interval. The vulnerable items are scanned at the next
   scheduled date and time. Alternatively, you can manually initiate a
   vulnerability scan using the Scan for Vulnerabilities
   related link.

   If the scan again finds the vulnerability on the configuration item and does
   not mark it Fixed, the vulnerable item returns to the Under Investigation
   state. Contact IT Operations to reopen the change request.

   If the scan does not find the vulnerability and returns that the vulnerable
   item has been marked Fixed, the vulnerable item transitions to the
   Closed-Fixed state and is closed during import.

   Only when all vulnerable items in a task are in the Closed-Fixed state, does
   the remediation task close automatically. Remediation tasks with vulnerable
   items in Closed states other than Fixed must be closed manually.
{#remediate-vuln-groups__steps_mph_k22_fbb}
* **[Defer a Remediation task](https://www.servicenow.com/docs/Lm~gCnNyRhKdRT6AmVlYHQ)**   
  If you determine that the issue associated with a remediation task (VUL) is a low priority and can be immediately deferred without further analysis, you can use the Request Exception feature.
* **[Close a remediation task](https://www.servicenow.com/docs/mZnT1oJCt5HVhKnMPQOGBQ)**   
  If you determine that the issue associated with a remediation task can be immediately closed without further analysis, you can use the Close feature. Starting with v23.0 of Vulnerability Response, the Close button has been removed for a remediation task and the closure of a remediation task is driven by the scanner.

**Related concepts**   

* [Steps to help prevent duplicate or orphaned records after running Vulnerability Response CI lookup rules](https://www.servicenow.com/docs/DA2_cEfqqQXs7KYpaBa8GA "Take steps to help prevent duplicate or orphan records resulting from matching (configuration items (CIs) within the CMDB.")
* [De-duplicating existing configuration items](https://www.servicenow.com/docs/Ap16VrNatM2VLHqh~E5jyg "Whenever configuration items (CIs) are updated through a deduplication task, the discovered items (DIs) that are related to those CIs are also updated. The vulnerable items (VIs) and detections are also updated with the CI.")  
**Related tasks**   

* [View and reclassify unmatched configuration items](https://www.servicenow.com/docs/EaEAOf7Ltyr9QZ_PQwhXPA "Configuration items (CIs) that are not found in the Configuration Management Database (CMDB) are placed in a viewable list of discovered items. This list offers a convenient way to reclassify unmatched CIs.")
* [Reconcile unmatched discovered items](https://www.servicenow.com/docs/XRpmXjp2BwfNkGu9fKxV5g "Create a scheduled job to reconcile unmatched discovered items.")

*[\>]: and then