Report a quarter, and get a finding acted on

applied · 90 min · Objective 4.1

Task

Produce the full quarterly reporting set from your lab's accumulated data, then take one finding all the way to an agreed, dated commitment. Objective 4.1 is vulnerability management reporting and communication, and communication is measured by whether anything moved.

Steps

  1. Build the trend set across your three cycles: backlog size, arrival rate against closure rate, median time to remediate by severity, and the ageing profile.
  2. Annotate every discontinuity. The cycle where you added a host and the cycle where a credential expired both moved the numbers for reasons that are not security, and unannotated they either provoke a panic or teach the reader to ignore the chart.
  3. Show the denominators everywhere: findings per asset with the asset count visible, and coverage beside every finding count.
  4. Report SLA compliance by owner, splitting "not done" from "not done by this team" -- blocked on a vendor, blocked on a freeze, blocked on another team.
  5. Report the exception register in aggregate, including the total accepted position and the exceptions expiring soon.
  6. Report recurrence explicitly: findings closed this period that had been closed before, and which source they recur from.
  7. Now take one finding and negotiate it: identify the real owner, write the ask, propose an interim mitigation, and agree a date. Record the exchange and the commitment.

Verify

awk -F, 'NR>1{print $9}' /tmp/backlog.csv | sort | uniq -c
awk -F, '$6=="deferred" && $8!=""' /tmp/backlog.csv | wc -l
awk -F, '$6=="deferred"' /tmp/backlog.csv | wc -l
awk -F, '$10=="recurred"' /tmp/backlog.csv | wc -l
grep -cE "^(owner|agreed date|interim):" /tmp/negotiation.md

Findings by owner, deferrals with an expiry against total deferrals -- those two must be equal -- and the recurrence count. The last confirms the negotiation produced the three things that make a commitment real: a named owner, a date, and what happens in the meantime.

Notes

The recurrence line is the only part of a vulnerability report that offers a manager something to decide rather than something to approve. "Your build image is generating this backlog" names a changeable cause; a count does not.

If the negotiation produced a date nobody believes, it produced nothing. A date imposed and missed teaches the organisation that dates are fictional, and that lesson then applies to the one that mattered.

This is an independent study companion for CompTIA CySA+ CS0-004 and is not produced by or endorsed by CompTIA.