TIPS FOR CREATING A STRONGCYBERSECURITY ASSESSMENT REPORT

Fill in the gaps in your understanding with follow-up
scans, documentation requests, and interviews.

Provide a practical remediation path, accounting forthe organization’s strengths and weaknesses.

This cheat sheet offers advice for creating a strong
report as part of your penetration test, vulnerability
assessment, or an information security audit.

Involve colleagues in your analysis to obtain otherpeople’s perspectives on the data and conclusions.

Qualities of a Good Assessment Report

Assessment Methodology Documentation

Open with a strong executive summary that a nontechnical reader can understand.

General Approach to Creating the Report

Document the methodology used to perform theassessment, analyze data, and prioritize findings.

Provide meaningful analysis, instead of merely
presenting the output of the assessment tools.

Demonstrate a systemic and well-reasoned
assessment and analysis approach.

Include the figures to support your analysis, placing
non-critical information in the appendix.

Clarify the type of the assessment you performed:
penetration test, vulnerability assessment, etc.

Craft a professional, easy-to-follow look.

1.

Analyze the data collected during theassessment to identify relevant issues.

2.

Prioritize your risks and observations; formulate
remediation steps.

3.

Document the assessment methodology andscope.

4.

Describe your prioritized findings andrecommendations.

5.

Attach the relevant figures and data to support
the main body of your report.

6.

Create the executive summary to highlight thekey findings and recommendations.

7.

Proofread and edit the document.

8.

Consider submitting the report draft to weed out
false positives and confirm expectations.

9.

Submit the final report to the intended recipient
using agreed-upon secure transfer mechanism.

If applicable, explain what tools you used and how
they were configured.

Offer remediation guidance beyond merely pointing
out security problems.
Find and fix your typos. Ask for help, if you can.

If applicable, describe what approach guided thequestions you asked during interviews.

Structure the report in logical sections toaccommodate the different types of readers.

Describe the criteria you used to assign severity or
criticality levels to the findings of the assessment.

Additional Assessment Report Tips

Refer to the relevant frameworks you used tostructure the efforts (PCI DSS, ISO 27001, etc.).

Create templates based on prior reports, so you
don’t have to write every document from scratch.

Scope of the Security Assessment

Safeguard (encrypt) the report when storing andsending it, since its contents are probably sensitive.

Specify what systems, networks and/or applications
were reviewed as part of the security assessment.

Use concrete statements; avoid passive voice.

State what documentation you reviewed, if any.

Explain the significance of your findings in thecontext of current threats and recent events.

10. Discuss the report’s contents with the recipienton the phone, teleconference, or in person.

List the people whom you interviewed, if any.

Analysis of the Security Assessment Data

Discuss what contractual obligations or regulatory
requirements were accounted for in the assessment.

More Security Assessment Tips

Document any items that were specifically excluded
from the assessment’s scope and explain why.

Tips for a Strong Executive Summary of a SecurityAssessment Report

Documenting Conclusions

Security Assessment Report as Critique, Not Criticism

Share your insights beyond regurgitating the data
already in existence.
Consider what information provided to you is
incomplete or might be a lie or half-truth.
Look for patterns by grouping your initial findings by
the affected resources, risk, issue category, etc.
Identify for trends that highlight the existence ofunderlying problems that affect security.
If examining scanner output, consider exploring thedata using spreadsheets and pivot tables.

Clarify the primary goals of the assessment.

Include both negative and positive findings.
Account for the organization’s industry, businessmodel, and compliance requirements.
Stay consistent with the methodology and scope.
Prioritize the findings related to security risks andremediation steps.

Put effort into making the report as brief as possible
without omitting important and relevant contents.
Qualities of a Good Information Security Report

Why Your Security Assessment Recommendations
Get Ignored

Training to Improve Your Writing
Lenny Zeltser, the author of this cheat sheet, createda writing course for cybersecurity professionals,
which you can take from SANS Institute.

Authored by Lenny Zeltser, who has written his share of security assessment and other reports. Thanks for the feedback on this cheat sheet to Dave Shackleford and John Strand. It’s distributed
according to the Creative Commons v3 “Attribution” License. You’re looking at version 1.1 of this document. For more security cheat sheets see zeltser.com/cheat-sheets.