Measures the effectiveness of the vulnerability management programme over a period and against the previous one. Every rate, distribution and change is calculated from your figures or from a selected register; the analysis and recommendations follow from them.
Contents
1. Document Information
2. Executive Summary
3. Reporting Scope and Period
4. Data Sources and Limitations
5. Overall Vulnerability Statistics
6. Vulnerability Severity Distribution
7. Vulnerability Status Distribution
8. New and Resolved Vulnerabilities
9. Remediation Performance
10. SLA Compliance
11. Overdue Vulnerabilities
12. Vulnerability Aging Analysis
13. Recurring Vulnerabilities
14. Assessment Coverage
15. Historical Trends
16. Key Performance Indicators
17. Identified Weaknesses
18. Improvement Recommendations
19. Management Review
20. Approval
What you provide
Deliverable — Its title, its author and its structure are yours: they steer what is written.
Report — The period measured.
Vulnerability statistics — Counted from a selected register when left empty.
Remediation performance — As measured.
Operational context — How much was actually looked at.
