For Teachers · Back to the Module · Print with your browser's Print command.

A3 Worksheet: Reporting and Communication

Student Worksheet (about 15 minutes, Applied level)

Name: ______________________ Class: __________ Date: __________

Read first: A2

Learning Objectives

• [ ] Describe the structure of an assessment report.
• [ ] Explain why limitations belong in every report.
• [ ] Share reports without leaking sensitive information.

Key Terms

Write each definition in your own words.

• SARIF: ______________________________________________
• Limitations: ______________________________________________
• Report Signing: ______________________________________________

Lab Tasks

Use only the simulated lab or a machine your teacher has authorised.

1. Open a sample report on openvapt.com and identify scope, methodology, findings and limitations.
2. Run: openvapt verify a1/report.json, then edit one character in the file and verify again.

Self-Check Questions

1. Why should a report list its limitations?

• [ ] a) To make it longer
• [ ] b) So readers do not mistake absence of findings for proof of security
• [ ] c) To hide findings
• [ ] d) So the report can claim compliance

1. What does a valid report signature prove?

• [ ] a) The machine is secure
• [ ] b) The report was not edited after signing
• [ ] c) The project endorses the report
• [ ] d) Every finding is real

1. Which order does NIST SP 800-115 recommend for a report?

• [ ] a) Scope and methodology, then findings, then limitations
• [ ] b) Findings first, then scope
• [ ] c) Limitations only
• [ ] d) An overall score, then a seal

1. Before sharing a report, what should you do?

• [ ] a) Post it publicly for transparency
• [ ] b) Review it for remaining secrets and share it only with people who need it
• [ ] c) Remove the signature
• [ ] d) Delete the limitations

1. Does OpenVAPT issue a security seal, score or certificate?

• [ ] a) Yes, after a clean scan
• [ ] b) No, never
• [ ] c) Only when there are no Critical findings
• [ ] d) Only for signed reports

Reflection

Which finding from this module would matter most on a server you are responsible for, and why?

________________________________________________________________

Sources

• NIST SP 800-115, Technical Guide to Information Security Testing and Assessment: https://csrc.nist.gov/pubs/sp/800/115/final
• OASIS SARIF 2.1.0: https://docs.oasis-open.org/sarif/sarif/v2.1.0/sarif-v2.1.0.html

Adapted from the OpenVAPT Academy (openvapt.com), built by AI Cybersecurity Engineers, used under the OpenVAPT Source-Available Licence 1.3. Free teaching use under TEACHING.md. Please cite OpenVAPT: see CITING.md or openvapt.com/cite.html. OpenVAPT is not affiliated with, and is not endorsed by, this institution or any third party named in this material. Pre-release versions may be wrong or unstable. Use at your own risk. If you adapt this material, say where you changed it.