Write the same findings four times

short · 50 min · Objective 4.1

Task

Take one dataset and produce four documents from it -- for the engineer, the manager, the executive and the auditor -- then check each against the question that reader is actually asking. One report for everyone serves nobody, and this is the cheapest way to prove it to yourself.

Steps

  1. Start from the verified backlog, not raw scanner output.
  2. Engineer. For the top five findings: the exact asset, what the scanner observed, what to do, how to verify, and one line on urgency. No trend charts, no executive summary.
  3. Manager. For one owning team: what is outstanding, what is overdue, what is newly urgent, and what they need from another team to finish.
  4. Executive. Under one page, no CVE identifiers at all: are we getting better or worse, what is the material exposure in business terms, what decision is being asked, and what happens if the answer is no.
  5. Auditor. The process as written, evidence it operated over the period, coverage of scope, exceptions with approvals and expiry, and metrics with dates.
  6. Now check each. For every paragraph, ask whether that reader would act differently for having read it. Delete every paragraph where the answer is no.
  7. Compare the four word counts and the overlap between them.

Verify

for f in /tmp/report-engineer.md /tmp/report-manager.md /tmp/report-exec.md /tmp/report-auditor.md; do printf "%-32s %5s words\n" "$(basename "$f")" "$(wc -w < "$f")"; done
grep -c "CVE-" /tmp/report-exec.md
grep -ciE "exception|accepted|expiry" /tmp/report-auditor.md
grep -ciE "verify|confirm" /tmp/report-engineer.md

The executive report must contain zero CVE identifiers and be the shortest by a wide margin. The auditor report must mention exceptions and expiry -- that is the reader's whole question. The engineer report must say how to verify the fix, because a remediation instruction without a verification step is half a ticket.

Notes

The word counts are a crude check and a real one. An executive report the same length as the engineer's has not been written for an executive, whatever its contents.

Step 6 is the discipline that makes reports shorter every time you write one. A paragraph that changes nothing for its reader is costing you the paragraphs that would.

This is an independent study companion for CompTIA CySA+ CS0-004 and is not produced by or endorsed by CompTIA.