Reporting Findings & Compliance Standards Flashcards

Which risk rating system uses a 0–10 numeric score to prioritize vulnerability severity in assessment reports?

Answer: CVSS (Common Vulnerability Scoring System)

CVSS provides a standardized 0–10 numeric score that helps organizations prioritize remediation based on vulnerability severity.

In a vulnerability assessment report, the 'executive summary' section is primarily intended for which audience?

Answer: C-suite and non-technical decision makers

The executive summary conveys high-level risk posture and business impact to senior leadership who may lack technical backgrounds.

Under PCI DSS, how frequently must internal vulnerability scans be performed at minimum?

Answer: Quarterly

PCI DSS Requirement 11.3 mandates internal vulnerability scans at least quarterly to maintain cardholder data environment security.

Which report element describes the specific steps taken to discover a vulnerability, enabling the reader to reproduce findings?

Answer: Methodology section

The methodology section documents tools, techniques, and scope applied during the assessment so findings can be validated and reproduced.

A vulnerability assessor must report a critical finding to a client mid-engagement that could allow immediate data exfiltration. What is the best course of action?

Answer: Issue an out-of-band verbal or written notification immediately

Critical findings with immediate business risk require prompt out-of-band notification rather than waiting for the final deliverable.

HIPAA's Security Rule requires covered entities to conduct which type of ongoing activity that directly informs vulnerability reporting?

Answer: Continuous risk analysis

HIPAA §164.308(a)(1) mandates ongoing risk analysis to identify threats and vulnerabilities to ePHI, feeding into remediation reporting.

Which CVSS v3.1 metric captures whether an attacker needs to exploit a secondary system to reach the vulnerable component?

Answer: Scope

The Scope metric indicates whether a vulnerability can impact components beyond the vulnerable component's security authority.