Centralises the vulnerabilities found, their context, status and history. Every finding gets its ID and a standardised description; duplicates, CVE and severity inconsistencies, missing data and overdue items are detected by calculation. Nothing is filled in for you: what you did not give stays “Not provided”.
Contents
1. Register Information
2. Scope and Assessment Sources
3. Vulnerability Inventory
4. Vulnerability Summary
5. Severity Distribution
6. Status Distribution
7. Overdue Vulnerabilities
8. Missing Information and Data Quality Issues
9. Register Review and Approval
10. Change History
What you provide
Deliverable — Its title, its author and its structure are yours: they steer what is written.
Register — Where these findings come from.
Affected assets — Each asset once: findings refer to it.
Vulnerabilities — Details, status and treatment of each finding.
