A municipal client asks for remediation guidance beyond a single urgent patch list. What framing should the report include?
Select an answer to reveal the explanation.
Short Explanation
Cities cannot boil the ocean on Monday morning. Give them tonight's fixes, this quarter's projects, and the longer roadmap so progress is real instead of overwhelming.
Full Explanation
When a municipal client asks for remediation guidance beyond a single urgent patch list, the report should frame short-, medium-, and long-term remediation themes that pair quick wins with strategic improvements (identity hygiene, segmentation, SDLC, monitoring).
Only irreversible infrastructure replacement with no interim controls is rarely practical. Claiming remediation planning is out of scope for all pentest reports abandons expected delivery. A single unsorted backlog without time horizons or owners does not drive civic action.
Exam caveat: remediation themes should be actionable and proportional—not a second full architecture redesign unless requested.
Operational check: group findings into horizon buckets with suggested owners, validate feasibility with technical contacts, and present the roadmap in the municipal closeout meeting. In municipal operations, record the rationale in the engagement notes so future assessors know which control was chosen and which failure modes the rejected options would create for city services. Re-validate after the next maintenance window that the same finding class still applies under the estate's current patch and configuration baseline. In municipal operations, record the rationale in the engagement notes so future assessors know which control was chosen and which failure modes the rejected options would create for city services.