Action Plans enable SecurityScorecard users to work with vendors to improve security. You can create an Action Plan from any scorecard you can open, including your own scorecard, a company opened from a portfolio, or a custom scorecard. The plan is scoped to whichever scorecard you start from.
How Action Plans work
Users can design plans targeting three improvement areas:
- Overall security score and letter grade
- Scores for specific factors (DNS Health, Application Security, etc.)
- Resolution of particular issues
When sent, vendors receive an email explaining the plan's purpose. Those with SecurityScorecard accounts can log in directly; others receive a link to create a free account.
Key limitations:
- Any user can send an Action Plan to a vendor, but that plan can only be seen by the user to whom it was sent, not by everyone in their organization.
- Removing a vendor from your Portfolio doesn't delete associated Action Plans. They will remain visible to both you and the vendor.
- Score targets are calculated on the cumulative score impact of all listed issues.
You and the vendor can track progress and communicate directly through the platform. Each time one of you sends a message, the recipient gets an email notification.
You can also change the scope of the plan at any time.
When the vendor completes all action items in the plan, the plan is marked Complete.
Create an Action Plan
There are two ways to start an Action Plan, and they behave differently.
From a scorecard
Click Create Action Plan under the score on the scorecard. This works from any scorecard — your own scorecard, a company opened from a portfolio (Companies > Portfolios), or a custom scorecard (My Organization > Custom Scorecards).
This creates a plan immediately, already scoped to that scorecard. You then open the plan to configure it — name it, set a completion deadline, choose an objective (overall score, factor score, or issue resolution), and select your targets.
From the Action Plans page
Open the Communications menu, go to Action Plans, and click Create plan. This builds a plan from scratch:
- Select the target company (by domain).
- Name the plan.
- Set a completion deadline.
- Choose an objective (overall score, factor score, or issue resolution).
- Select specific details and targets:
- For overall score improvement, select a target score and letter grade.
- For factor score improvement, select factors and then select a target score and letter grade for those factors.
- For issue resolution, select issues.
- Click Create plan.
This entry point lets you select a company by domain only; it does not offer custom scorecards. To scope a plan to a custom scorecard, start from the scorecard itself as described above.
Whichever way you start, the plan appears in the Action Plans page in the creator's Created by us tab; vendors see it under Assigned to us.
Managing action plans
Open a plan to track its progress and manage its contents.
Plan overview
The top of the plan summarizes its status at a glance. Score target shows the current score alongside the goal (for example, 82 → 100, "Achieve 100 overall security score"). Progress shows the percent complete, with a breakdown of issues by status (Open, Under review, Resolved). Due date shows the plan's deadline and indicates when it is overdue.
Chat and share
Use Chat to open a conversation thread for the whole plan, where you can message your teammates and the vendor about it. (To discuss a single issue instead, use Start a conversation in the table — see below.) Use Share to share the plan and manage who has access.
Edit the plan and other options
Click the ... (more options) button at the top right of the plan to perform the following actions. Some appear only when they apply to you, based on your permissions or the plan's status:
- Edit
Update the plan's details, such as name, due date, and target. This option is not available once a plan is resolved. - Export to CSV
Download the plan's issues as a CSV file. - Accept as resolved
Mark the entire plan as resolved, even if some issues are still open. You enter a reason, which is saved to the plan's conversation thread. - Archive
Achive the plan. - Delete
Permanently delete the plan.
Work with issues in the plan
The table lists every issue in the plan, with its severity, impact, findings count, source, factor, and status. To remove one or more issues, select the checkbox next to each one and then click Remove. To discuss a single issue with the vendor, go to the Conversations column and click Start a conversation.