The Evaluation Report: Writing for Two Audiences at Once

Prerequisites

• STE-K009: CVSS Scoring
• STE-K010: Evidence Documentation

Why This Lesson Matters

An STE report serves two readers who have almost nothing in common: a CISO who needs business impact in plain language, and a developer who needs to know exactly which line of code to change. Writing for only one of them wastes the entire engagement. This lesson builds the report structure that serves both.

1. The Two-Audience Problem

CISO reads:
  "Five Critical findings were identified. The most severe allows any
   internet user to access all customer data without authentication.
   Remediation priority 1 requires 48 hours of developer time."
  → Enough to make a budget decision.

Developer reads:
  "Blind time-based SQL injection via the id parameter of GET /api/products.
   Confirmed with payload id=1;SELECT SLEEP(5)-- (5.2s delay observed).
   Fix: replace line 42 of ProductController.java with a parameterised
   PreparedStatement."
  → Enough to fix the code without scheduling a meeting.

Both are in the same report. Different sections.

2. Report Structure

STE Evaluation Report
├── 1. Cover Page
│     Classification, version, evaluator, date, engagement ID
├── 2. Executive Summary (1 page)
│     → Written for: CISO, Board, Legal
├── 3. Evaluation Scope & Methodology
│     Controls evaluated, test environment, limitations
├── 4. Results Summary
│     Risk rating table; chart; key statistics
├── 5. Detailed Findings
│     → Written for: developers, system owners
│     One section per finding, following STE-K010 template
├── 6. Compliance Summary (if applicable)
│     Pass/fail table per control requirement
├── 7. Remediation Roadmap
│     Prioritised action plan with owners and due dates
└── Appendices
      A. Test case inventory
      B. Evidence register (exhibit IDs → file locations)
      C. Tool output (raw scanner reports)
      D. Scope and authorisation document

3. Executive Summary: Three Paragraphs

Paragraph 1 — What was tested and when:
  "A security evaluation of the Customer Portal v3.2 was conducted between
   June 8–22, 2026, covering 24 controls defined in the Corporate Security
   Standard CSS-2026."

Paragraph 2 — What was found (business language):
  "The evaluation identified 5 Critical, 3 High, and 4 Medium findings.
   The most impactful finding (F007) allows any authenticated user to gain
   administrator privileges within 30 seconds, without any special knowledge
   or tools. This defeats all downstream access controls."

Paragraph 3 — Status and recommendation:
  "All Critical and High findings were communicated to the development team
   during the engagement. Recommended action: remediate all Critical findings
   within 7 days, initiate a retest within 14 days. Overall, the system does
   not meet CSS-2026 requirements and should not be promoted to production
   until at least the Critical findings are resolved."

4. Results Summary Table

| Severity | Count | Controls Affected | Remediation Target |
|---|---|---|---|
| Critical | 5 | CSS-AC01, CSS-IN01 (×2), CSS-A01, CSS-LOG01 | 7 days |
| High | 3 | CSS-A02, CSS-ERR01, CSS-HDR01 | 30 days |
| Medium | 4 | Various | 90 days |
| Low / Info | 6 | Various | Best effort |
| PASS | 12 | — | — |
| N/A | 3 | — | — |

5. Compliance Summary Table

| Control ID | Control Name | Result | Finding Ref |
|---|---|---|---|
| CSS-A01 | MFA for admin accounts | FAIL | F002 |
| CSS-A02 | Session timeout (30 min) | PASS | — |
| CSS-AC01 | Role-based access control | FAIL | F007 |
| CSS-IN01 | SQL injection prevention | FAIL | F004, F005 |
| CSS-LOG01 | Security event logging | FAIL | F011 |
| CSS-ERR01 | Error message suppression | FAIL | F008 |
| CSS-CORS01 | CORS policy | PASS | — |
| CSS-HDR01 | Security response headers | FAIL | F009 |

This table is what the compliance officer and auditor look at first. Every FAIL links to a detailed finding.

6. The Remediation Roadmap

REMEDIATION ROADMAP

Tier 1 — Within 7 days (Critical findings)
  F007: Implement server-side role validation on /api/users/update-role
        Owner: Backend team  |  Estimate: 4 hours
  F004: Replace dynamic SQL with prepared statements in ProductController
        Owner: Backend team  |  Estimate: 8 hours
  F002: Enforce MFA for all admin accounts via IdP policy
        Owner: IT Operations  |  Estimate: 2 hours
  F001: Restrict /api/internal/* endpoints to authenticated sessions
        Owner: Backend team  |  Estimate: 2 hours
  F011: Enable security event logging for all auth and admin events
        Owner: DevOps  |  Estimate: 4 hours

Tier 2 — Within 30 days (High findings)
  F008: Replace verbose error messages with generic HTTP 500 page
        Owner: Backend team  |  Estimate: 3 hours
  F009: Add HSTS, CSP, X-Frame-Options, X-Content-Type-Options headers
        Owner: Frontend/DevOps  |  Estimate: 2 hours

Retest recommendation:
  Retest all Tier 1 remediations within 14 days of deployment.
  Retest all Tier 2 remediations within 45 days of deployment.

7. Common Mistakes

Mistake 1: Executive summary that contains CVE IDs or exploit payload strings. The CISO does not need to know the payload. They need to know the business risk. Save the technical detail for Section 5.

Mistake 2: Results table with no context. "5 Critical findings" without saying what they affect or what remediating them requires is useless. Every number needs a sentence of context.

Mistake 3: Remediation roadmap with no owners. "Fix the SQL injection" with no owner means it goes in the backlog forever. Assign a team or role to every item.

8. Practice Exercises

1. Write a three-paragraph executive summary for this scenario: "Evaluation of a healthcare API found 3 Critical, 4 High findings. Most critical: unauthenticated access to patient records. System should not be deployed."

2. Create a compliance summary table for six controls: CSS-A01 (FAIL, finding F001), CSS-A02 (PASS), CSS-AC01 (FAIL, F002 and F003), CSS-IN01 (PASS), CSS-LOG01 (N/A — system has no admin functions), CSS-CORS01 (FAIL, F004).

3. Produce a Tier 1 remediation roadmap entry for finding F007 (privilege escalation) with: owner (backend team), 4-hour estimate, and specific remediation action.

9. Lab

Assessment mode: quiz

You are given 8 completed findings from a simulated STE engagement. Produce: 1. A 3-paragraph executive summary 2. A results summary table 3. A compliance summary table (10 controls) 4. A Tier 1 + Tier 2 remediation roadmap

Scoring: each section graded on accuracy, completeness, and audience-appropriateness.

10. Framework Alignment

11. Further Reading

• SANS STE Report Template — https://www.sans.org/reading-room — Search "evaluation report template"
• NIST SP 800-53A — Section 4 covers assessment report format for federal systems
• ISO/IEC 27007 — Guidelines for auditing information security management systems — directly maps to the report structure above

["Write a three-paragraph executive summary for a described STE engagement with five findings that uses only business language and explicitly avoids technical jargon", "Produce a compliance summary table for ten described controls with correct pass/fail/N/A classifications and finding references for all failed controls", "Write a complete Tier 1 remediation roadmap section for three Critical findings, each with owner, time estimate, and specific actionable remediation steps"]

Prerequisites → Why this matters (two-audience problem) → Report structure (7-section outline) → Executive summary (3-paragraph template) → Results summary table → Compliance summary table → Remediation roadmap → Common mistakes → Practice exercises → Quiz lab → Framework alignment → Further reading