Penetration Testing Report Writing Help
A scope of the penetration test should be displayed prior to any findings. Explain the authorisation, the exclusions, assumptions and rules of engagement to enable the reader to comprehend the nature of the evidence.
The pattern for each finding should be the same: Affected asset, observed condition, evidence, security impact, risk rating and remediation. This format facilitates comparison of findings and allows the assessor to observe the relationship between the technical observations and the professional judgements.
Remediation should be actionable. Explain why the weakness is the root cause, identify the control or configuration change and explain its priority and describe how the organisation could confirm the weakness is reduced after the control or configuration change had been implemented.