Reporting and Communication
Reporting and Communication
This domain tests whether you can translate technical findings for three audiences: executives (risk, cost, business impact), operations (what to fix and in what order), and legal/regulators (obligations and deadlines). The most common error is audience mismatch - a forty-page packet-capture analysis is not an executive summary, and a one-line "we patched it" is not a compliance record.
Know the contents of an incident report: executive summary, timeline with timestamps and time zone, scope and impact (systems, data, customers), root cause, indicators of compromise, actions taken, current status, lessons learned, and prioritized recommendations. Vulnerability reporting should include scan scope and coverage, counts by severity, aging and trend over time, exceptions and accepted risk, and performance against remediation SLAs.
Metrics are frequently tested. MTTD is time to detect (incident start to detection), MTTA is time to acknowledge, and MTTR is time to respond or remediate - usually detection to recovery. Definitions vary by organization, so the correct exam answer is the conceptually right one: detection speed versus resolution speed. Also expect patch compliance rate, scan coverage percentage, false-positive rate, and count of overdue critical findings.
Compliance deadlines are worth memorizing: GDPR requires notifying the supervisory authority within 72 hours of becoming aware of a personal data breach, with affected individuals notified without undue delay where there is high risk. Breach-notification laws, PCI DSS, HIPAA, and contractual SLAs differ - legal counsel owns the determination, not the SOC analyst.
Data classification governs sharing: label and handle PII, PHI, and confidential material per policy, and redact sensitive artifacts in reports.
Worked example. Malware first appears at 09:00, the SOC alerts at 09:45, and the host is clean and back in service at 12:30. MTTD = 45 minutes. MTTR measured from detection = 2 h 45 m; measured from incident start = 3 h 30 m. Always state your definition, because the number changes.