A transit authority VA must serve both executives and system owners. Which reporting quality best drives remediation?
Select an answer to reveal the explanation.
Short Explanation
A useful VA report is a work order, not a scrapbook of CVE stickers. Say who owns the fix, why it matters, and what "done" looks like.
Full Explanation
A transit-authority VA that must serve executives and system owners drives remediation best when findings map to owners, clear severity context, and actionable fixes—not only a raw CVE dump. Shipping only CVE identifiers with no asset names blocks accountability. Omitting remediation guidance forces owners to invent fixes blindly. Replacing technical detail with marketing screenshots of the scanner UI fails both audiences. Exam caveat: executive summaries and technical appendices can differ in depth, but both need accurate severity and ownership. Operational check: tag each finding with asset, owner team, business service impact, and remediation steps; review a sample with transit stakeholders before final delivery. Document the rationale in the municipal engagement notes so later civic responders know which boundary was honored and which failure modes the rejected options would create for public services. Document the rationale in the municipal engagement notes so later civic responders know which boundary was honored and which failure modes the rejected options would create for public services. Document the rationale in the municipal engagement notes so later civic responders know which boundary was honored and which failure modes the rejected options would create for public services.