Negotiate one finding to a dated, owned commitment

applied · 80 min · Objective 5.2

Task

Take one finding from your own lab engagement all the way to an agreed, dated commitment: identify the real owner, write the ask, propose an interim mitigation, and record the exchange — because communication is measured by whether anything moved, not by whether the finding was correct. Objective 5.2 is documentation and communication.

Steps

  1. Take one real finding from your own lab work into /tmp/negotiation.md.
  2. Identify the real owner — the person or team who can actually fix it, not the first contact you have.
  3. Write the ask: the fix at the level of the cause, framed as a decision the owner can make, with the business impact leading.
  4. Propose an interim mitigation for while the real fix is built — a compensating control that reduces the risk now.
  5. Role-play the exchange and record the commitment: a named owner, an agreed date, and what happens in the meantime.
  6. Note what you would check at re-test to confirm the commitment was met.

Verify

grep -cE "^(owner|agreed date|interim):" /tmp/negotiation.md
grep -ciE "business impact|decision|real owner" /tmp/negotiation.md
grep -ciE "re-?test|confirm|check" /tmp/negotiation.md

The first count must be at least 3 — the three things that make a commitment real: a named owner, a date, and an interim mitigation. The second must be non-zero: you led with business impact and framed it as a decision, which is what gets a finding acted on. The third must be non-zero: you recorded the re-test criterion, which closes the loop.

Notes

A named owner, a date, and what happens in the meantime are the three things that turn a finding into a commitment — without them, "we reported it" is where it ends. Communication is scored on whether anything moved, which is why the interim mitigation matters: it reduces risk now while the real fix is built. Everything drew on your own lab findings, and the exchange is a role-play, not a real client.

This is an independent study companion for CompTIA PenTest+ PT0-003 and is not produced by or endorsed by CompTIA.