Skip to main content

​
Working Findings

A finding represents an issue or condition identified through Cyber Op Source assessment work and intentionally published for client use.

​
Start with the finding details

Review:
  • title and description,
  • affected area,
  • severity or risk information when provided,
  • supporting client-safe context,
  • recommended treatment or next step,
  • ownership and status,
  • related actions or evidence requests.
If the finding does not match your understanding, use the available collaboration mechanism or contact the engagement team. Do not simply upload evidence unrelated to the disputed point.

​
Finding versus treatment

The finding describes the condition that requires attention. A treatment describes how the organization plans to address or manage that condition. One finding may have one or more treatment-related activities over its lifecycle.

​
Publication matters

Client users work with the published representation of a finding. Internal assessment notes or draft material are not automatically part of the client-facing record. This keeps the client workflow stable while allowing Cyber Op Source to maintain internal workpapers separately.

​
What to do when you agree

When the finding is understood:
  1. review the recommended treatment,
  2. confirm who should own the work,
  3. identify any required client actions,
  4. provide relevant evidence as work progresses,
  5. keep progress notes concise and factual,
  6. complete assigned actions when the work is actually done.

​
What to do when you disagree

A disagreement may arise because:
  • the underlying fact is incorrect,
  • the environment changed after assessment,
  • compensating controls were not considered,
  • the recommendation is impractical,
  • responsibility belongs elsewhere.
Provide specific information that allows the issue to be evaluated. Where applicable, propose a treatment alternative rather than only rejecting the recommendation.

​
Closure

A client marking work complete does not necessarily close the finding. Cyber Op Source may need to review evidence, verify implementation, or complete the assessment-side closure process.