Developing a deliverable can be broken into a few stages, as shown in the following diagram. The first stage is Project Review. This is where the service provider reviews the statement of work, customer business objectives, areas of concern, and proposed value to provide. All of this plus additional identified material is used to build a report template.

The next step is filling in the report template during the Information Collection stage. Information captured includes devices identified, processes used, vulnerabilities found, verification of vulnerabilities, suggested remediation, and other data.

Once all data is captured and aligned with the template, the third phase is preparing a First Draft. This draft will not be customer facing and contain as much data as possible. Last is the Review phase, used to slim down the report to the strongest data along with tuning to meet business demands in a professional manner. Best practice is having both a technical and professional writer edit the draft to make sure it addresses both executive and technical staff requirements.