In this guide, you will learn how to use the Action Plan function in Kiuwan. 

Contents: 

What is an Action Plan?

Once you have analyzed an application with Kiuwan, you will have a bunch of results.  

Most likely, you will not decide to fix all the defects found, but a subset of them.

That subset of defects to be fixed will be decided based on very different considerations, from technical to economic reasons.

The most common reasons have to do with the technical impact of the defects and available effort to fix them.

Those defects, together with target dates and responsible, constitute an Action Plan.

Kiuwan helps you during this process:

1. To decide which defects should be fixed based on your goals, and state a concrete plan
2. To monitor the progress of the plan

Let’s go through those steps together. 

Create an Action Plan

As said above, the Action Plan can be decided based on several factors, such as technical considerations and/or economical reasons.

To decide which defects to fix, Kiuwan lets you:

1. Do it on your own (by manually selecting the defects to be fixed based on an inspection of defects found), or
2. Build an action plan based on your goals and a simulation (What If) of different scenarios

Let’s suppose we have an application with the following results:

Just by seeing these results, it might be hard to decide where to start to fix vulnerabilities. Even if it tells me how much effort I need to invest to reach a certain number of stars, how do I know what the biggest priority is? The answers to these questions depends on your business and technical needs. 

Kiuwan helps you with creating an Action Plan with you, suited to your needs. 

Select Action Plans from the menu.

Click the hamburger menu to see your options: 

1. New action plan = create a new action plan manually.
2. What if = open a simulation tool and let Kiuwan help you detect those defects that will most contribute to fulfilling your goal

Manual creation of an Action Plan

From the hamburger menu, click New action plan to create a plan manually. 

Here you can select the defects you are most interested in fixing, based on your business' needs. 

For example, let’s suppose that you are very concerned about security and you want to make sure that OWASP-related defects should be fixed. That’s your plan.

To do it, filter the defects list for the appropriate criteria (or any subset you consider).

Then,

1. Select the defects you want to fix
2. Click on Save This Action Plan. 

A new window will appear. 

You will see the number of defects contained in this action plan, the estimated effort required to fix them as well as the metrics before and after the fulfillment of the action plan.

It is mandatory to enter a name in the Name field in order to save the action plan. 

Once you have saved the plan, you can view it at any time in the Action Plan dashboard.

Kiuwan-aided creation of an Action Plan (What If)

What if you want to improve your code but you don’t know where to start?

Well, the What if feature helps you generate an automatic action plan with a given quantity of available hours or a quality goal you want to achieve.

Rather than manually selecting the specific defects, Kiuwan finds those defects that should be fixed according to your needs.

The What if tool allows you to simulate as many scenarios as you want, letting you build an action plan based on two different strategies:

1. Effort-based
2. Indicators- based 

Effort-based

You could decide to spend a certain amount of hours to fix tasks. 

For example, let’s suppose you have 1 week (40 hours) to dedicate, so you will need to identify those defects that will return you the highest return.

Kiuwan will distribute the effort to maximize Global Indicator.

You can specify the total amount to be distributed across all the characteristics or the amount to dedicate only to certain characteristics.

In the example, the application has acceptable levels for Efficiency, Portability, and Reliability, so you could decide to spend those 40 hours distributed evenly in Security (20h) and Maintainability (20h).

Indicators-based

As another approach to effort-drive, you could decide to improve any of the characteristics to meet a certain value.

For example, using our example, you could want to have a plan to reach 50 for Security and reach 30 for Maintainability.

What-If let you specify this and any other combination that suits your needs.

As with the effort-based approach, Kiuwan will generate the optimized listing of defects that should be fixed to meet the indicated values.

Saving an Action Plan

Whatever is the approach (effort- or simulator-driven), by clicking on the Simulate button Kiuwan will generate the full list of defects to be fixed, as well as the future values of Kiuwan indicators after completion of the Action Plan.

Click on Save this action plan button to create the Action Plan, or continues the simulation until you find an appropriate plan that suits your needs.

Monitoring the execution progress of an Action Plan

Clicking on Action Plans tab of Code Analysis will show all the available Action Plans for the selected application.

For every Action Plan, Kiuwan provides the following information:

• Name of the plan
• Creation and Expiration Dates
• Starting analysis (where the Action Plan comes from)
• Number of defects (to fix to fulfill the plan)
• Estimate (effort needed to fix all the defects of the plan)
• Assignee (responsible to fulfill the plan)
• Progress (%)
• Pending Effort

Action Plan Progress (%) is calculated as the percentage of defects fixed in the last application analysis as compared to the defects when the action plan was created.  By clicking on the Progress link, you will be presented with a detailed Progress page.

Pending Effort is calculated as the effort to fix the remaining defects.

As the application is further analyzed, Kiuwan will update progress indicators for every plan. 

Detailed Progress of an Action Plan

Clicking on the Progress link of any action plan, you will be presented with the detailed Progress page.

At this page, you will be able to see the Remediation Timeline, i.e. a temporal view of the execution progress of the plan.

By hovering the mouse over any point you will see details such as analysis date and fixed vs total defects.

Progression information will be presented for any analysis you choose (selecting the analysis in the selection list).

Circle graphics display information on Progress as well as Pending Defects (classified by Priority and Software characteristic).

Also, you will be presented with three tabs with a breakdown of the action plan’ s defects ;

• Full listing of Total defects of the action plan
• Removed defects in the selected analysis
• Pending defects in the action plan

Export information from an Action Plan

Once you have an Action Plan, most probably you will want to communicate the defects to fix the involved developers or 3^rd party providers.

You can do it in two ways, either exporting the plan to a PDF or CSV or by creating the defects as Issues in JIRA.

Clicking on PDF you will get a full detailed PDF report.