Vulnerability management reporting and communication focuses on giving stakeholders the information they need to prioritize, assign, track, and complete remediation. That typically includes:
* Risk severity / risk score (to prioritize and communicate urgency)
* Timelines (when fixes are due, often tied to SLOs/SLAs and internal targets)
* Dependencies (what must happen first or what systems/teams a fix relies on)
* Remediation ownership / responsible parties (who is accountable for fixing each item) This maps directly to Option D.
Exact extract (CompTIA CySA+ CS0-003 Exam Objectives - Vulnerability management reporting):
Vulnerability management reporting includes "Risk score ... [and] Prioritization." Exact extract (Secbay Press - Key components of action plans used for reporting/communication):
* "Timeline and Prioritization: Specify timelines for addressing each vulnerability..."
* "Responsible Parties: Clearly identify individuals or teams responsible..."
* "Communication Strategy: Outline how the organization will communicate progress..." These are the same practical reporting/communication items expressed in Option D:
* "Risk severity levels" # risk score / severity used for prioritization
* "Timelines" # timeline definition in action plans
* "Remediation ownership" # responsible parties/accountability
* "Dependencies" are commonly tracked because they affect timelines and ownership (for example, engineering/ops sequencing and prerequisite changes), and they align with the objective's focus on prioritization/action planning and stakeholder communication.
Why the other options are not the best match:
* A includes items that are valuable inputs to prioritization (risk assessment, BIA), but vulnerability reporting/communication (per objectives) is centered on reporting vulnerabilities, affected hosts, risk scoring, mitigations, recurrence, prioritization, and action plans, not BCPs as core reporting factors.
* B mixes relevant items (MTTR, dependencies) with disaster recovery plans, which are DR/BC-focused rather than core vulnerability reporting elements.
* C includes several incident response / SOC monitoring metrics (alert volume characteristics, MTTD) that are not the primary focus of vulnerability management reporting (even though false positives can be tracked as a VM metric, the overall set is misaligned).
References (CompTIA CySA+ CS0-003 documents / study guides used):
* CompTIA CySA+ CS0-003 Exam Objectives v4.0: vulnerability management reporting includes risk score and prioritization; action plans and stakeholder communication
* Secbay Press, CompTIA CySA+ Exam Prep Guide (CS0-003): action plan components include timelines, responsible parties (ownership), and communication strategy