The city CISO must update leadership on open vulnerabilities, remediation progress, and residual risk for critical citizen services. Which vulnerability-management activity does this communication fulfill?
Select an answer to reveal the explanation.
Short Explanation
Leaders need the story, not a raw dump of scanner noise—how many open vulns, what is fixed, and what risk is left on citizen services. That status roll-up is reporting, and it does not mean turning scanners off or posting exploit kits.
Full Explanation
Reporting is the vulnerability-management activity that translates technical posture into stakeholder decisions. The city CISO’s update on open vulnerabilities, remediation progress, and residual risk for critical citizen services gives council and department leaders context to fund fixes, accept residual risk formally, or adjust priorities—without replacing the underlying technical program.
Replacing all technical controls with a single verbal briefing abandons scanning and patching in favor of theater. Stopping scans so reports always show zero findings fabricates a clean posture and leaves real issues undiscovered. Publishing raw exploit PoCs on the public website endangers citizens and systems; transparency for leadership is not the same as dumping weaponized detail to the Internet.
Exam caveat: reporting feeds governance and risk acceptance; it does not itself remediate. Metrics should include trend, age of criticals, SLA compliance, and business-service mapping—not raw unvalidated dump volume.
Operational check: produce a recurring leadership pack with validated critical/high counts by citizen service, aging, exception list, and next milestones; keep exploit details in restricted channels; and align reported residual risk with formal acceptance records.