For any given issue or group of issues, ability to convey: 1. a detailed description of the problem, 2. A list of affected components, 3. Possible sources of further information, 4. A description of the risk posed in terms of Confidentiality, integrity and Availability of the system and its data, 5. The cause of the issue, 6. Which type of attacker would most likely exploit the issue, 7. the difficulty and likelihood of a successful exploit, 8. The potential impact to the customer’s information systems and data preferably in terms of CIA, 9. Detailed recommendations for remediation, drawing upon extensive product specific knowledge where possible and providing suitable general recommendations where not (senior or principal responsibility).