Reporting Findings & Compliance Standards Flashcards

Which compliance framework specifically requires organizations to maintain a formal vulnerability management program as part of its Critical Security Controls?

Answer: CIS Controls

CIS Control 7 (Continuous Vulnerability Management) mandates a formal program for identifying, tracking, and remediating vulnerabilities.

In vulnerability reporting, 'residual risk' refers to:

Answer: Risk that remains after controls are applied

Residual risk is the remaining exposure after security controls have been implemented and accepted by the organization.

When a vulnerability affects multiple systems across different network segments, the report finding should include which of the following to aid remediation teams?

Answer: A complete asset inventory listing all affected hosts

Listing all affected hosts gives remediation teams a complete picture of the attack surface to ensure no instances are missed during patching.

Under FISMA, federal agencies must report vulnerability assessment results through which reporting mechanism?

Answer: CyberScope or equivalent OMB reporting portal

FISMA requires agencies to report security metrics including vulnerability scan results through OMB's reporting channels such as CyberScope.

Which report element is specifically designed to track open findings from previous assessments and confirm their current remediation status?

Answer: Remediation tracking or findings retest section

Remediation tracking sections compare prior findings against current assessment results to document whether vulnerabilities were successfully addressed.

A vulnerability rated CVSS 9.8 should be assigned which remediation priority timeline according to best practices?

Answer: Within 15 days or immediately

Critical CVSS scores (9.0–10.0) typically require immediate or very rapid remediation, often within 15 days or fewer per most vulnerability management policies.

The 'limitations' section of a vulnerability assessment report is important because it:

Answer: Defines what was not tested, preventing misinterpretation of scope coverage

Documenting scope limitations prevents clients from assuming the report represents a complete security certification of untested areas.