Route findings and translate one into a decision

applied · 75 min · Objective 1.3

Task

Take a set of findings, route each to the right stakeholder at the right time, and translate one critical finding from CVSS into a sentence a non-technical executive can act on. Objective 1.3 is collaboration and communication, and it is scored on whether the right person learned the right thing in time.

Steps

  1. In /tmp/routing.md, list five findings of mixed severity and, for each, record to: (technical contact / sponsor / system owner / legal), when: (immediate / in the report), and why:.
  2. Make at least one finding critical enough to escalate before the report, and route it to the technical contact first, not straight to an executive.
  3. Take that critical finding and write /tmp/exec.md: one paragraph that leads with the business consequence, names who could do it and what they would need, and ends with a decision to make — not a bare severity score.
  4. Write the escalation itself: through the agreed path, impact first, what you have and have not done, and the immediate mitigation you propose.
  5. Re-read the exec paragraph and delete every acronym a finance director would not know. If removing them breaks the sentence, the sentence was jargon.

Verify

grep -cE "^to:\s*(technical contact|sponsor|system owner|legal)" /tmp/routing.md
grep -cE "^when:\s*(immediate|in the report)" /tmp/routing.md
awk '/^when:\s*immediate/{i++} END{print i" immediate route(s)"}' /tmp/routing.md
grep -ciE "could|would|decision|before|fix" /tmp/exec.md

The first two counts must be 5: every finding has a recipient and a timing. The third must be at least 1 — nothing routed as immediate means you are holding a critical finding for the report. The last must be non-zero: an executive translation that contains no consequence, actor or decision is a score dressed up as a sentence.

Notes

Sending a critical finding straight to an executive without warning the engineer who has to fix it makes an enemy of the one person whose help you need. And the executive paragraph is judged by whether it produces a decision: "fix this before launch" is actionable; "this is very serious" is a feeling. The translation is the skill, and it is most of what separates a rehired tester from a replaced one.

This is an independent study companion for CompTIA PenTest+ PT0-003 and is not produced by or endorsed by CompTIA.