4 PHD only

Description of Vulnerability

Security Control Number and Name

Security Control Type

System Categorization for Risk Level Impact

Last Assessment Information

Asset

Assessment Method

Policy Alignment

<Describe the vulnerability>

<List the Security Control name and number>

<Common, System-Specific, Hybrid>

<High, moderate, or low>

<Identify any security assessments from the past>

<Describe the asset that will be tested>

<Identify at least one way you can test this asset>

<Indicate what security policy aligns with the asset>