What is the primary purpose of the Findings section in a security assessment report?

• A. To provide the remediation steps for each finding
• B. To list vulnerabilities discovered with risk levels and evidence
• C. To describe the testing environment
• D. To present client billing details

Answer: (B)

The Findings section is where you document what was found during the assessment, listing each vulnerability or issue with its risk level and the supporting evidence. This makes it easy for stakeholders to see a concrete inventory of problems, prioritized by how severe they are, and to verify each item with concrete proof like screenshots, logs, or test outputs.

Remediation steps belong in a separate Recommendations section, not in Findings, because Findings should focus on what and how severe the issues are, while Recommendations tell you how to fix them. Details about the testing environment or methodology live in their own sections (Scope/Environment or Methodology), not in the Findings. Administrative items like client billing are out of scope for the security findings.