Vulnerability Assessment Report Template for Canada

Statistics Canada reported that 16% of Canadian businesses were affected by a cybersecurity incident in 2023, down from 18% in 2021 and 21% in 2019. Yet recovery spending doubled, rising from approximately $600 million in 2021 to $1.2 billion in 2023, according to Statistics Canada's report on business cybersecurity incidents. A smaller share of affected businesses doesn't mean the consequences are getting cheaper.

A vulnerability assessment report is a dated management record of what was assessed, how it was assessed, what was found, what the weaknesses could mean for the business, who owns each fix, when it's due, and what risk remains. Done well, it helps leadership choose practical actions before a known weakness turns into downtime, exposed records or an expensive recovery.

Why Canadian Firms Need This Report

A mid-sized firm's incident might begin with an exposed remote-access service on a file server. A scanner can flag the weakness, but the business risk depends on whether someone can reach the server, what information it holds, and who can restrict access before operations are disrupted. A higher technical score on an isolated test machine may matter less than a lower-scoring weakness on a system that holds client records.

Statistics Canada's incident data show that most affected businesses don't report incidents to police. The internal record still matters: preserve evidence, assign an accountable owner and document the response, even when no external report is made.

A useful report gives each reader a clear decision or action:

• The owner sees the business risk and decides which fixes to fund.
• The operations lead sees what could interrupt patient care, production, shipping or client service.
• The IT manager sees what was tested, what was not, and who must act next.

Tie each weakness to the systems and processes it could affect, then name a realistic owner and deadline. Include unscanned assets and identity paths in the risk discussion; a scanner's coverage limits do not make those exposures disappear. For firms handling personal information, relate relevant findings to the privacy obligations they follow, including applicable Canadian data privacy laws.

A vulnerability assessment identifies and rates weaknesses across a defined scope. A penetration test checks whether an attacker could chain weaknesses into access. State which method was used and what it did not establish.

Keep the report even if nobody files an incident externally. Management, auditors and insurers may still need a record of what was exposed, what was done, who owned the response and what risk remains.

Recommended Sections in Every Report

Start with this table. It's a report outline a team can copy into a document and fill in. The Canadian Centre for Cyber Security recommends recording risk-assessment results in a formal report or equivalent security and privacy plan, including scope, methods, findings, business impact, owners, deadlines, residual risk and retest status. Its guidance also calls for monitoring and scanning at an organisation-defined frequency and when newly relevant vulnerabilities are identified, as described in the Centre's risk-assessment guidance.

Vulnerability assessment report parts to include

Fill in scope and coverage before findings

Document control prevents an old draft from being mistaken for the approved report. Record the assessment date, version, classification, author and approver. In scope and method, name the assets assessed, exclusions, dates, tools and versions, and whether testing was authenticated or unauthenticated and announced or unannounced.

For a cloud assessment, record whether the provider was notified and authorised the activity. An unapproved scan can look like hostile activity or breach the provider's terms. Don't claim full coverage if a clinic device, supplier connection or server wasn't assessed. List the item, its owner if known, and why the assessment couldn't confirm its security.

Coverage confidence deserves its own line. An unknown asset or unscanned device is a reportable gap, not a minor footnote. A blank owner or missing retest field also means that part of the report isn't complete.

Give every section a job

The executive summary asks leadership for decisions; it shouldn't repeat the technical register. The inventory shows what was and wasn't assessed. The findings register links evidence to assets, while the business-impact section explains what an issue could do to a business process. The remediation record assigns action, owner and deadline. Residual risk records what leadership accepts, what controls remain and when to review the decision.

Don't limit privacy-sensitive assessments to CVEs and missing patches. Include relevant exposure paths such as third-party access, excessive permissions, weak retention controls and inadequate monitoring. State what evidence supports each conclusion and distinguish it from assumptions.

Use rule: If a report part has no reader and no decision, cut it. If a decision has no named owner and date, the report isn't finished.

Risk Ratings Leaders Can Act On

A remote-access or identity weakness exposed to the internet can be a greater business risk than a critical flaw on an isolated, non-essential system. Don't let the highest CVSS score automatically win. The Cyber Centre's 2025–2026 National Cyber Threat Assessment says publicly known vulnerabilities continue to be exploited, threat actors constantly scan for known weaknesses, and the number of CVEs continues to grow.

Rate each finding against internet exposure, active exploitation, asset criticality, privilege gained, confidentiality, integrity and availability impact, exploit prerequisites, control coverage and remediation feasibility. CVSS can help describe technical severity, but leadership also needs to know what an attacker could reach and which service might stop working.

Risk ratings for a vulnerability assessment report

These deadlines are a practical reporting scale, not a substitute for judgment. If a legacy clinical or plant system can't be patched immediately, record the compensating control, accountable owner, and review date. Don't leave the item open or treat an exception as a completed fix.

Group related findings into an attack path. For example, exposed remote access, weak authentication and excessive privileges may combine to create a route into important systems. Management can then fund a coherent risk reduction rather than close isolated tickets without addressing how the weaknesses work together. A clear risk management framework can help keep assessment decisions connected to business priorities.

Executive Summary Language That Lands

Write the summary for the director who won't read the findings register. Keep it to one page and state what was tested and when, what was out of scope, the decisions leadership must make, and the residual risk if nothing changes. Avoid CVE codes, product banners and raw CVSS scores here. Use a finding ID to direct technical readers to the evidence.

Use sentence patterns that make decisions clear:

1. Scope: “On 12 March 2026, we assessed internet-facing access, identity, endpoints and the systems that store client records. Medical devices on the isolated clinical network were excluded and are listed as a coverage gap.”
2. Decision: “We ask you to fund MFA and retire the unused VPN within seven days because that access path could interrupt scheduling for about a business day.”
3. Impact: “Among Canadian businesses affected by cybersecurity incidents in 2021, approximately 40% experienced downtime, with average downtime lasting 36 hours, according to Statistics Canada. For this firm, the identified risk could stop billing for the business day.”

That last sentence uses a Canadian benchmark as context, not as a prediction of this firm's outage. State the likely local effect in plain language, and don't imply an exact downtime estimate unless your assessment supports it.

Make the requested decisions explicit, with an owner and date. For example, name the operations director as the person accepting a legacy-server exception until 30 June 2026, and state the control already in place. Also explain what leadership is not being asked to do, so a medium finding doesn't get mistaken for an emergency.

Bad: “Critical vulnerabilities require immediate attention.”

Better: “Approve the access restriction for finding VA-2026-014 by Friday. The server holds client billing files, and the change reduces the risk of unauthorised access while IT completes the remaining work.”

For regulated clients, use calm, specific wording without fear language. The summary is ready when a director can repeat the top risk, the cost of waiting and the first decision without calling IT.

Technical Findings with Evidence Examples

A finding should let an asset owner understand the issue, verify the evidence and take a defined action. Use this example as a complete pattern. Every other finding should carry the same fields, even when it describes an identity or configuration weakness rather than a CVE.

Finding VA-2026-014

• Issue: Exposed remote desktop on a finance file server.
• Technical score and rating: CVSS 8.1. Rated Urgent because the service is internet-facing and the access observed grants administrative privilege.
• Evidence: Attach a screenshot showing the open port from the approved test host. Record the timestamp, tool name and version, and the account privilege observed. Don't include exploit steps.
• Exploitability: A known weakness is reachable without special user action; active scanning of known weaknesses is common.
• Affected process: Client billing files and the same-day close.
• Business effect: Unauthorised access could expose or damage files and interrupt billing. Statistics Canada found that affected businesses experienced average downtime of 36 hours in 2021, but that figure is context, not a forecast for this firm. State the local scenario as a same-day billing stoppage, not an invented dollar loss.
• Current control: No compensating control is in place on the host. Firewall logging exists, but it wasn't alerting on this activity.
• Remediation options: Restrict access to a known address range, require MFA, then patch or retire the service.
• Owner and deadline: Name one accountable infrastructure owner and set a deadline within the Urgent band.
• Validation: Retest from the same host, attach evidence that the port is closed, and record who approved the result.

Separate observation from assumption. If the assessor didn't see a backup for the server, write “backup status unknown”, not “protected by backups.” Evidence should show what the assessor confirmed, when they confirmed it and which asset it concerns.

Not every material finding has a CVE. For example, an identity finding might read: “Microsoft 365 has excessive global-admin accounts; list the accounts observed, their assigned roles, the assessment date and the evidence reviewed. Name the identity owner, state the access change required, and attach the validation result.” This kind of evidence helps keep identity risks visible alongside software flaws. Teams that need to monitor server vulnerabilities with Fivenines can use scanning as an input, but the report still needs human validation and a business owner for each action.

Use the finding ID consistently in the summary and technical register. A sound vulnerability scanning process can identify issues, but a finding isn't ready for leadership until it states the asset, identifier if any, evidence, exploitability, affected data or process, current controls, owner, deadline and retest.

Remediation Sequence for the First 90 Days

A flat ticket dump asks a busy team to fix everything at once. A short sequence makes the work staffable and gives leadership checkpoints. In 2025, 15% of Canadian small businesses and 21% of Canadian medium-sized businesses reported being affected by a cybersecurity incident, while exploitation of software, hardware or network vulnerabilities accounted for 23% of incidents among affected businesses, according to Statistics Canada.

The same Statistics Canada release found that 47.6% of businesses and organisations didn't plan additional cybersecurity measures in the second quarter of 2025; among those, 58.4% said they didn't need them. A report must make the need for action clear while keeping the work specific enough to assign.

First 90 days after the vulnerability assessment report

Every action needs a specific type: patch, configuration change, segmentation, access restriction, detection rule or retirement. Assign one accountable owner, a deadline based on the rating, validation evidence and a retest result. “Improve security” isn't an action someone can complete or verify.

Resource limits matter in a firm with a small IT team. If one administrator makes production changes, don't schedule every High finding for the same week. Sequence changes around system dependencies and approved maintenance windows, without allowing a deadline to disappear from the report.

Publish the sequence beside the findings and review it at the next monthly meeting. Mark each item done, late or accepted; for accepted risk, record the control, decision-maker and review date. A practical vulnerability management approach turns the report into a work plan rather than a PDF that nobody revisits.

Cross-References for Regulated Sectors

A vulnerability report should connect technical findings to the records and business services they could expose or disrupt. A clinic's highest CVSS score may not represent its greatest business risk: an unscanned medical device, an over-privileged supplier account or an identity path into sensitive records may matter more. Record the exposure, potential downtime, relevant privacy obligations and a realistic owner for each concern.

Sector cross-references for the report

For healthcare, trace access through over-privileged accounts, stale supplier access and missing MFA. Record unmanaged medical or IoT devices, third-party connections, Microsoft 365 configuration and missing logs. For legal, accounting and finance firms, document who can access client files, how long records are retained and where backups are stored. For manufacturers and logistics operators, identify systems that could halt production or shipping, then name the owner responsible for each controller.

Name the privacy or health-information obligations the client already follows, such as PIPEDA, Quebec's Law 25 where it applies, or provincial health-information rules. The report can connect those obligations to assessment evidence, but it is not legal advice and should not invent a control framework. A compliance risk management framework can help organize that connection.

If a system or data flow was not tested, mark it outside scope. This keeps readers from treating an unassessed asset as covered.

Format the Report and Book the Review

Deliver two useful artefacts: a versioned PDF for controlled distribution and a findings spreadsheet that asset owners can filter by deadline, owner and rating. Put the client name, classification, assessment date and page numbers in the PDF header. Use the same finding IDs in the executive summary, register and evidence appendix.

Keep the report confidential. Give leadership a summary that leaves out exploit detail and host names they don't need, while keeping technical evidence available to authorised readers. Put screenshots in an appendix, with alt text that identifies the finding ID and what the image proves. Record the distribution list, the retention period set by the client's policy and who may forward the report to an insurer or auditor.

Book a 30-minute read-out to cover the top three decisions, accepted exceptions and the day-30 checkpoint. Don't treat a one-time PDF as current indefinitely: schedule the next assessment at the client's defined frequency and when newly relevant vulnerabilities emerge. File each retest beside the original finding ID so the history stays traceable.

Before the meeting ends, assign owners and put the first checkpoint on the calendar. CloudOrbis provides leadership with monthly operational reporting, quarterly strategic technical reviews and cybersecurity compliance reporting, including patch compliance and insurance-ready documentation, through a manager dashboard.

CloudOrbis Inc. offers a free IT Risk Assessment to help identify weaknesses, clarify scope and turn findings into a prioritised vulnerability assessment report. Visit CloudOrbis Inc. to start the assessment, agree the scope in writing and schedule your first 30-day checkpoint.