How do you document and communicate remediation progress to stakeholders?

• A. Post a single tweet.
• B. Keep the information in a private folder and not share.
• C. Use issues, pull requests, release notes, Security Advisories, and dashboards; include CVSS and remediation steps.
• D. Only update the source code without commentary.

Answer: (C)

Documenting remediation progress in a structured, transparent, and auditable way helps stakeholders understand what’s happening, why it matters, and how risk is being reduced. The strongest approach uses the project’s existing collaboration and release artifacts to communicate clearly and traceably: issues capture what needs to be done and track progress; pull requests record the actual code changes along with rationale and reviews; release notes summarize what was fixed and when it was released; Security Advisories publicly disclose vulnerabilities and mitigations, providing context and guidance to users and other teams; dashboards offer a high-level, ongoing view of status, trends, and metrics. Including CVSS scores helps convey the severity and urgency of each vulnerability, while detailing remediation steps gives engineers concrete guidance on how to implement and verify fixes. This combination ensures visibility, accountability, and actionable information across technical and non-technical stakeholders, and supports governance and audit requirements as remediation work progresses.

Posting a single tweet lacks depth and long-term visibility; keeping information in a private folder without sharing avoids the need-to-know and misses important transparency; updating only the source code without commentary omits context, impact, and timelines that stakeholders rely on to assess risk and progress.