Reporting Findings & Compliance Standards Flashcards

Which standard provides a structured vulnerability disclosure process used by vendors and researchers to coordinate patching before public release?

Answer: ISO/IEC 29147

ISO/IEC 29147 provides international guidance on vulnerability disclosure, defining roles and processes for coordinated disclosure between researchers and vendors.

When assigning severity in a report, which factor would most likely DECREASE a CVSS base score?

Answer: High privileges required to exploit

Requiring high privileges to exploit a vulnerability reduces its CVSS score because it limits who can carry out the attack.

A client requests that a vulnerability with active exploit code be omitted from the final report to avoid alarming stakeholders. What should the assessor do?

Answer: Include the finding and document client's request to omit it

Assessors must maintain report integrity; the finding should be included while documenting the client's request to ensure accountability.

GDPR Article 33 requires that personal data breaches discovered during a vulnerability assessment be reported to the supervisory authority within:

Answer: 72 hours

GDPR mandates notifying the relevant supervisory authority within 72 hours of becoming aware of a personal data breach unless it poses no risk.

Which vulnerability assessment report component provides step-by-step instructions to eliminate or mitigate each identified weakness?

Answer: Remediation recommendations

Remediation recommendations give technical teams actionable steps to fix or mitigate vulnerabilities, including patches, configuration changes, or compensating controls.

Under FedRAMP, cloud service providers must achieve which scan pass rate for high-severity vulnerabilities before receiving an Authority to Operate (ATO)?

Answer: 100% remediation or documented POA&M within defined SLAs

FedRAMP requires all high vulnerabilities to be remediated or have an accepted Plan of Action and Milestones (POA&M) within defined timelines as a condition of ATO.

Which metric in a vulnerability report helps stakeholders understand the likelihood that a specific vulnerability will be exploited in the wild?

Answer: CVSS Temporal Score (Exploit Code Maturity)

The CVSS Temporal Score's Exploit Code Maturity (ECM) metric reflects whether functional exploit code exists, adjusting base scores to reflect real-world exploitability.