How do I remediate configuration drift?

More context

Classification matters because not all drift is bad. A setting that moved away from the benchmark baseline is a regression and needs rollback or a documented exception. A setting that tightened beyond the baseline is an improvement and should update your target state, not trigger a rollback. Remediating without classifying produces churn and can undo deliberate hardening.

The verification rescan is the step manual workflows skip most often: without it, the record shows a fix was attempted, not that compliance was restored. CISGuard detects drift continuously, attaches remediation guidance to each failed control, and confirms closure by rescan, so the compliance record reflects verified state rather than assumed state.