Reporting Findings & Compliance Standards Flashcards

Which NIST publication provides guidance on the vulnerability management lifecycle, including reporting phases?

Answer: NIST SP 800-40

NIST SP 800-40 specifically addresses patch and vulnerability management, including guidance on prioritization and reporting.

A false positive in a vulnerability scan report is best described as:

Answer: A vulnerability reported that does not actually exist in the target

A false positive occurs when the scanner flags a vulnerability that manual validation confirms does not actually exist in the environment.

Under SOC 2 Type II requirements, how long must an organization demonstrate continuous control effectiveness for reporting purposes?

Answer: A minimum observation period (typically 6–12 months)

SOC 2 Type II reports cover a defined period (commonly 6–12 months) to demonstrate sustained control effectiveness over time.

Which section of a vulnerability assessment report maps discovered weaknesses to specific business assets and quantifies potential financial impact?

Answer: Risk register or risk matrix

The risk register or risk matrix correlates vulnerabilities with affected assets and estimates business impact to guide prioritization.

ISO/IEC 27001 requires organizations to document vulnerability management results in which artifact?

Answer: Risk treatment plan

ISO 27001 Annex A Control 8.8 requires identified vulnerabilities to be addressed within a risk treatment plan documenting selected controls.

When reporting vulnerabilities under responsible disclosure, what is the standard maximum embargo period before public disclosure?

Answer: 90 days

The industry standard coordinated vulnerability disclosure window is 90 days, popularized by Google Project Zero, before public release.

A CVE identifier in a vulnerability report primarily serves to:

Answer: Provide a unique public reference to a specific known vulnerability

CVE IDs provide a standardized, publicly referenced identifier so different tools and teams can unambiguously refer to the same vulnerability.