List the findings, say what fixes each one, and get the date each is due: by severity from the day the client was told, and for a missing update from the vendor's release under the NCSC's and Cyber Essentials' clocks, whichever is sooner.
The day the report was delivered, or for a critical finding phoned through during testing, the day of the call. That is when the clock starts for code, configuration and design findings.
The defaults are the guide's. Change any of them to what your firm or your client has agreed, and the dates follow.
| Finding | Severity | Contain by | Fix by | Set by |
|---|---|---|---|---|
| SQL injection in the search API | Critical | - | Set the date the client was told | |
| Missing operating system update on a web server | High | - | Set the date the client was told | |
| Session cookie without the Secure flag | Medium | - | Set the date the client was told |
Kept in this browser only. Nothing you type here is sent anywhere.
Code, configuration and design findings, which are most of what a penetration test finds, have no vendor release to start from, so their clock starts when the client is told and runs by severity.
Missing vendor updates started their clock at the vendor's release. The NCSC's timescales apply whatever the severity, and Cyber Essentials sets its own limit for critical and high-risk updates on devices in its scope. The tool takes whichever date is earliest and says which rule set it, and a date that had already passed when the report was delivered is shown as overdue.
A finding known to be exploited is due faster than any of these, and on an internet-facing system the NCSC advises checking for signs of compromise before updating it.
In Pental clients see their findings in your white-labelled portal, track remediation and request retests, and each finding keeps its retest status, so a deadline is followed through to a retest rather than a reminder email. See how delivery works.
From Pental’s remediation timelines guide: critical findings contained within 48 hours and fixed within 14 days, high within 30 days, medium within 90 and low within 180. For a missing vendor update the NCSC’s best-practice timescales apply from the update’s release: 5 days for internet-facing services and software, 7 for operating systems and applications, 14 for internal or air-gapped systems, and Cyber Essentials allows at most 14 days for a critical or high-risk update on a device in its scope.
Because every framework’s clock for an update starts at the vendor’s release, not at your report. An update released ten weeks before the test is already weeks past the NCSC and Cyber Essentials deadlines when the report lands, and the finding should say so.
The earliest. A high finding that is a missing update on an internet-facing server is due in 5 days from the update’s release, not 30 days from the report.
When the client is told: for a critical finding phoned through during testing, the day of the call; for everything else, delivery of the report.
Yes. Open Your Firm’s Own Timelines and change any figure to what your firm or the client has agreed; the dates follow. Your figures and findings are kept in this browser only.
No. It sets dates from the figures shown. Where a client relies on your timelines to meet a regulatory obligation, have your own terms checked for that client’s regulator.
The tools are free and stay free, and so is our open-source reporting tool. Pental is the platform they come from.
Pental is pentest management and reporting for testing firms: findings scored as you write them, reports in your own Word template, QA review and a white-label client portal. Free trial, no card required.