Question

A CySA+ analyst is establishing the vulnerability management reporting program for a mid-sized company. The CISO wants a high-level trend summary suitable for the quarterly board meeting, the IT operations manager needs a detailed weekly list of unremediated findings to assign work, and the compliance team requires monthly evidence that PCI DSS in-scope systems are being scanned on schedule. Which approach BEST addresses these needs?

Accepted Answer

Tailor separate reports for each audience with content, detail, and cadence matched to their role — quarterly trend summaries for the board, weekly detailed remediation lists for IT ops, and monthly compliance evidence

Answer

Produce a single comprehensive report containing all raw scan data and distribute the same version to every stakeholder to ensure consistency

Answer

Send only the weekly detailed remediation report to all parties, since it contains the most current and granular data

Answer

Delay all reporting until the annual PCI DSS assessment so that a single validated dataset can be delivered to every stakeholder at once