Reporting and Communication

Two reports reach the security manager on the same morning: one says the payment server's critical vulnerability is fixed, the other says customer data was stolen. The first might mean a patch was deployed or that a rescan verified the fix took effect; the second might be a confirmed finding or a working assessment. Reporting and Communication, at 16% the smallest of the four CS0-004 domains, teaches you to write and read such claims with one mental model: reports are tailored to their intended audiences and decisions, and every claim in a report is only as strong as the evidence and scope behind it. The classic trap is the answer that reports more certainty than the evidence supports, such as a deployed patch presented as a verified closure, a suspected finding presented as confirmed, or a clean scan presented as proof for assets that were never scanned.

The first question is what the report is about, and the answer sends you to one of two pages. Communicate Vulnerability Management Findings and Risk covers vulnerability management reporting: this guide models a vulnerability on an affected asset as a finding record (asset, evidence, priority, owner, status and dates), while the vulnerability scan report, compliance finding, risk scorecard, action plan, and metrics and key performance indicators (KPIs) draw on tracked findings for administrators, auditors and leadership, including how a blocked fix is reported as a named inhibitor to remediation. Report Security Operations and Coordinate Incident Communications covers security operations and incident response reporting: an alert opens an assessment, an incident is declared only when the analyzed activity meets the organization's incident criteria, and from then on the communication work falls into the four communication jobs that the National Institute of Standards and Technology (NIST) names in NIST SP 800-61 Rev. 3 (incident coordination, incident notification, public communication, incident information sharing), alongside the executive summary, shift handover, after-action report, internal threat intelligence report and security operations center (SOC) metrics. Reach for the first page when the subject is a weakness waiting for a fix, and the second when the subject is an alert or a declared incident.

Across both streams prefer the option that says exactly what a status or figure covers and sends it to whoever has the authority to act. A figure needs its population and its clock: a false-positive rate means nothing until the report states what it divides by, a time metric means nothing until the report states the events that start and stop its clock, and a remediation SLA (service-level agreement) is checked against its agreed scope and deadline rather than a good average being taken as proof that every commitment was met. Authority follows the same instinct, with one word used two ways: in vulnerability management reporting, escalation means raising a remediation blocked beyond the assigned team's authority to someone who can decide, while incident reporting follows Rev. 3, where escalation adds response resources or time and elevation brings in a higher level of management, so a containment decision only leadership may make is elevated. Which notification laws apply is legal counsel's call, not the analyst's.