Security findings

A tester records a security finding under the relevant engagement. The affected asset identifier, severity and evidence make the observation concrete enough for the security lead to review. A finding starts Open, can move into Remediating, and then reaches Retest when the response is ready to check. Closed and accepted risk are distinct outcomes in the record.

• Tie evidence to scope. Tester links each finding to its engagement and identifies the affected asset.
• Show the work state. Security Lead moves an open issue into remediation; Tester checks the asset after it reaches retest.
• Separate outcomes. Keep a closed issue distinct from one recorded as accepted risk when reviewing the finding list.

Agree who identifies the affected asset, how evidence is handled, and which severity definitions the team uses. The status should describe the current work rather than the date someone last touched the record. The security lead should decide who coordinates remediation; the tester should know when the issue has reached the point for a retest.

For a pilot, choose an asset already named in the engagement and give its finding a severity and attachment. Security Lead should compare the asset to the authorized target text before coordinating remediation. Agree who will move a finding into Retest and who will inspect the asset then; a changed status alone does not describe what the tester observed.

Take an issue found on one authorized asset. Link it to the client’s engagement, record the asset identifier and the observation evidence, then set the severity. When the response begins, move the issue to Remediating. Move it to Retest when the response is ready for the tester’s check. Review the retained evidence before choosing an outcome. Keep the accepted-risk outcome distinct from a closed fix in reports.

Ask the person receiving the work to open the record without extra explanation. They should be able to tell what the current state means, which evidence supports it, and what decision they are expected to make. If they cannot, revise the entry and repeat the handoff with the same case.

The engagement link supplies the testing boundary; the finding itself holds the affected asset and evidence. Security Lead should compare those two records before coordinating a response. At retest, Tester can reopen the evidence and identify the exact asset to check. A finding’s severity is separate from its work status, so both deserve review.

• Open security findings — Affected assets and recorded evidence stay with each engagement.
• Findings for retest — Tester can find affected assets waiting for another check.

See the related process for the handoff, decision and rehearsal. Review roles before granting access and the data model when preparing records.