Reporting & Communication (17%)

Audience-Appropriate Communication: Executives/Board: business risk, financial impact, regulatory exposure, strategic recommendations — no CVE numbers. IT/Security: technical details, reproduction steps, remediation instructions. Legal: breach notification obligations, evidence preservation. Business units: process changes affecting operations. Regulators: required format and timeline per applicable law.

Key Metrics: MTTD (Mean Time to Detect — from compromise to awareness). MTTR (Mean Time to Respond/Remediate). SLA compliance rate (% of vulnerabilities patched within defined timeline). Risk exposure trend (are critical unpatched vulnerabilities increasing or decreasing?). False positive rate (detection quality indicator).

Responsible Disclosure: Notify vendor privately. Allow reasonable remediation time (90-day standard). Coordinate public disclosure with vendor when patch available. Document the timeline. Full public disclosure after deadline regardless of patch status. Protects all users by giving vendors time to fix before attackers know.

Breach Notification: GDPR Article 33: supervisory authority within 72 hours of awareness. Article 34: affected individuals when high risk. HIPAA: individuals within 60 days, HHS notification requirements. US state laws: vary 30-90 days. Involve legal counsel to determine applicable requirements before drafting notification.

Report Types: Vulnerability scan report (technical findings for remediation teams), Executive summary (risk posture for leadership), Gap analysis (current vs target maturity), Lessons learned (post-incident improvements), Metrics/dashboard (ongoing operational status), Compliance report (control effectiveness against framework).