MU measure 15 security risk assessment – does CMS require remediation in same attestation period?

It is good to show atleast few of the remediation action taken during the attestation process.  Though not a requirement for MU attestion, OCR/HHS audit will fine the covered entities if they have not taken any measure to fulfill the gap.