A CISO asks the vulnerability management team to prepare a quarterly report for the executive leadership committee, which decides on funding and risk acceptance. Which content is MOST appropriate for this internal report?
Select an answer to reveal the explanation.
Short Explanation
Executives don't want the phone book; they want the weather report. Show them whether things are getting better or worse, whether you're hitting fix-time targets, and what that means for the business. The raw dump is the trap - it's accurate and completely useless at that table.
Full Explanation
Internal vulnerability reporting must fit its audience. An executive committee decides on resources and risk acceptance, so it needs aggregated, decision-oriented information: how many critical and high findings remain open, whether that number is trending up or down, how remediation times compare with agreed targets, which business services carry the most exposure, and where exceptions or accepted risks exist. That framing connects technical findings to funding and risk decisions. Full raw scanner output is appropriate for system administrators who remediate individual hosts, but it overwhelms an executive audience and hides the trends that matter. Exploit code and reproduction steps are sensitive technical details that belong with remediation teams under controlled access; distributing them broadly increases risk and serves no leadership decision. A bare list of CVE identifiers names flaws without severity, status, asset value, or business impact, so it cannot support any judgment about priorities. Exam caveat: the same data feeds several reports, and tailoring detail to the audience is the skill being tested. Operational check: before each quarterly report, confirm that every metric shown has a defined target and owner and that accepted risks list their expiration dates.