Question

A penetration tester has completed the assessment and is preparing the final report for a mid-sized financial services client. During the closeout meeting, the client's CISO asks how the tester's findings should be integrated into the organization's existing governance framework so that remediation efforts can be tracked over time and prioritized against other operational threats. Which action BEST supports this request?

Accepted Answer

Map each finding to entries in the client's risk register with severity ratings and recommended remediation timelines

Answer

Provide the client with the raw scanner output files so their team can re-run the tools independently

Answer

Recommend the client purchase a continuous automated scanning subscription to replace the risk register

Answer

Deliver only the executive summary since detailed findings are the tester's proprietary methodology