CompTIA CySA+ CS0-003 (V3) Practice Question

The correct answer identifies the primary stakeholders who need to be aware of significant vulnerabilities affecting critical systems: the IT manager, the CISO, and the affected business unit leader. The IT manager is involved in the technical remediation process. The Chief Information Security Officer (CISO) is responsible for the overall security posture and risk management. The affected business unit leader must be aware of potential impacts on business operations.

The other options are incorrect. A customer service representative typically does not play a direct role in vulnerability mitigation. Likewise, a public relations manager becomes involved if an incident impacts customers, not typically at the initial internal reporting stage. External auditors are generally informed later as part of compliance reviews, not as immediate stakeholders for internal reporting. While high-level executives like the CEO and CFO would be informed of severe, business-threatening risks, they are not the primary operational contacts for an analyst's initial report. Finally, product vendors are only notified if the vulnerability originates from their product, as part of a coordinated disclosure, not as primary internal stakeholders.