CREST CCT cheat sheet

Reporting, Communication and Professional Conduct

• Report structure: executive summary (business risk, no jargon), scope and methodology, findings ranked by risk, technical evidence, remediation guidance, and appendices.

• Each finding entry states title, affected asset, severity with its scoring rationale, description, reproduction steps, evidence, business impact, and specific remediation.

• Severity must be contextualized: a critical CVSS on an isolated lab host may be low business risk; explain the adjustment rather than silently changing the score.

• Reproduction steps must be sufficient for a third party to verify the issue without the tester present, including credentials, URLs, payloads, and expected versus observed results.

• Responsible disclosure: report privately to the asset owner, agree a remediation timeline, and do not publish details before the agreed date or authorization.

• Data handling: store evidence encrypted, transfer over approved channels, and delete or return client data at engagement close per the contract.

• Professional conduct: stay strictly inside the authorized scope, stop and notify on discovering out-of-scope sensitive data, and avoid actions that could affect availability without written approval.

• Verbal briefings should lead with the highest-risk items and the decisions the client must make; written detail follows, so the audience is not lost in technical narrative.