# Reporting Stage — Elaboration

## Criteria Guidance

### Good criteria — concrete and verifiable

- "Each finding includes severity rating (CVSS), affected asset, reproduction steps, evidence artifacts, and specific remediation guidance"
- "Executive summary communicates overall risk posture in business terms understandable by non-technical stakeholders"
- "Remediation plan prioritizes fixes by risk-reduction impact and includes both quick wins and strategic improvements"

### Bad criteria — vague (no clear check)

- "Report is written"
- "Findings are documented"
- "Remediation is suggested"

