CySA+ v4 · Objective 4.1

Communicating vulnerability risk

Turn scan output into accountable remediation decisions, and report progress with business context, dependencies, and honest measures.

What you will be able to do

  • Write a vulnerability finding with reproducible evidence and an actionable ownership record.
  • Adapt risk communication to technical owners, business decision-makers, and compliance stakeholders.
  • Explain remediation blockers and document interim controls and escalation.
  • Interpret trends and SLA results using stable scope and explicit denominators.

Learn the concepts

  1. Lesson 1

    Write findings that an owner can act on

    A scan result starts a conversation about a system; it does not finish the risk decision. Effective reporting lets the recipient understand the evidence, the business consequence, and the action they own.

    Open lesson →
  2. Lesson 2

    Report what is preventing risk reduction

    A useful status report explains why risk remains and what decision would change it. Numbers support that explanation only when their scope, definitions, and limitations remain visible.

    Open lesson →

Apply your judgement · Synthetic scenario

The patch that needs a business decision

A fictional distribution company has a validated weakness in its dispatch service. A supplier approval is pending, and the next planned maintenance window is three weeks away. Leadership sees a falling scan count and asks whether the risk can be closed.

Finding VR-42
Dispatch service reachable by partner accounts; validated weakness affects shipment scheduling.
Dependency
Supplier must approve the update; application owner has requested compatibility testing.
Temporary control
Access restricted to named partner networks; monitoring added; control validation recorded.
Coverage change
This month: 180 assessed assets and 72 findings. Last month: 240 assessed assets and 96 findings.

Your task

  1. Write the decision needed from leadership without overstating the impact.
  2. Describe the status of the interim mitigation and permanent action plan.
  3. Explain why the count trend alone does not prove improvement.
Compare your response

Request an accountable decision on the maintenance window and supplier escalation. State that the validated weakness creates a risk to dispatch operations; do not claim shipment data was altered without incident evidence.

Keep VR-42 open or in the organisation’s explicit mitigated status. Record the access restriction, its validation, residual partner-account exposure, supplier and application owners, testing dependency, target date, and exception review point. Require retesting before verified closure.

Both asset coverage and finding count fell by one quarter. The figures do not establish that the assessed environment became safer. Explain the missing sixty assets, restore appropriate coverage, and compare consistent populations before claiming a reduction.

Put it into practice

Use these labs alongside this module.

Check your understanding

Choose the best response to each scenario, then check your reasoning. These are course practice questions.

1. A supplier has not approved a patch for a proprietary production system. Which report entry best supports a decision?
2. Open findings fall from 80 to 40 while the assessed asset population falls from 160 to 80. What is the most defensible conclusion?
3. An engineer reports that a patch ticket is complete. The action plan defines closure as a successful targeted rescan and service test. What should the status report show now?

0 of 3 answered

← Course curriculumNext module: 4.2 →

Source reading: supplied book, chapters 12. Lessons, scenarios, and questions are original CyberCorps course material.