A county stakeholder wants CVSS numbers only and no written impact narrative. What should the tester advocate?
Select an answer to reveal the explanation.
Short Explanation
A number without a story is like a speed limit sign with no road. Scores help sort the queue; narratives tell the county why it matters on their systems.
Full Explanation
If a county stakeholder wants CVSS numbers only and no written impact narrative, the tester should advocate pairing numeric scores with narratives that explain real municipal impact and triage context. Scores without story under-serve councils, CISOs, and operators.
Removing all scores for jokes about risk is unprofessional. Delivering CVSS alone because narratives supposedly confuse every audience fails leadership and technical readers differently. Replacing both with a single red/yellow sticker oversimplifies civic decision-making.
Exam caveat: different audiences may get different depth, but numbers-only packages are incomplete for CPTS-style delivery.
Operational check: provide CVSS alongside plain-language impact for top findings, show how narrative changes priority among similar scores, and agree on the dual format in the county reporting template. In municipal operations, record the rationale in the engagement notes so future assessors know which control was chosen and which failure modes the rejected options would create for city services. Re-validate after the next maintenance window that the same finding class still applies under the estate's current patch and configuration baseline.