Documentation, Reporting & Engagement Delivery

CPTS · 15 questions

• A city engagement is halfway complete and the tester has only sparse notes. What documentation practice should they adopt immediately?
• A county executive summary is being drafted. What content approach best fits a leadership audience?
• A municipal client asks for remediation guidance beyond a single urgent patch list. What framing should the report include?
• A library assessment finds the same vulnerability class on a jury PII system and on a public brochure site. How should severity be handled?
• A transit internal compromise needs to be explained in the report. What should the attack-path section emphasize?
• A city requests appendices covering what changed during testing. What operational content belongs there?
• A county stakeholder wants CVSS numbers only and no written impact narrative. What should the tester advocate?
• A municipal critical finding is fixed mid-engagement and the tester is asked to verify. How should the report treat that work?
• A library stakeholder meeting requires communicating serious findings. What tone is most appropriate?
• A water utility engagement is ending and tester-introduced shells or forwards may still exist. What closeout obligation applies?
• A city agreed at kickoff on a report template with executive summary, findings, remediations, and appendices. What should the tester do at delivery time?
• A county contact asks the tester to omit a material finding that would embarrass a vendor. What is the ethical response?
• A municipal enterprise-style assessment produced a lucky path to Domain Admin early. What else should the engagement still demonstrate?
• A transit client requests raw password lists be sent over ordinary email. How should the tester handle sensitive evidence delivery?
• A city proposes measuring engagement success solely by how many critical findings were produced. How should the tester reframe success?