How should audit findings be tracked to remediation and verification of closure in cybersecurity engagements?

• A. Record findings and archive them without action.
• B. Define root cause, remediation actions, owners, due dates, evidence of remediation, follow-up testing, and management sign-off upon closure.
• C. Wait for external audits to fix issues.
• D. Only track high-severity findings.

Answer: (B)