Generating and releasing a report

Generate

Generate a report for the engagement. This runs a job through the isolated rendering sidecar and produces the file in the engagement's report locale. A generated report is internal at this point: it exists, with its integrity hash, but the client cannot see it yet.

Review and release

Releasing runs a short review of the report's compliance mappings, finding by finding, for a last look before you confirm. On release the report freezes: the published finding revisions it contains, the compliance mappings with their provenance, and the remediation due dates are captured as they stand, so the delivered report keeps saying what it said even as the findings keep evolving.

Delivery

Once released, the report is visible to the client through the portal, over an authenticated, scoped, TLS channel, scoped to that client. Each released milestone (the first report, interim retest reports, the final one) is downloadable there, so the deliverables live in one controlled place instead of email attachments.

What comes after

From here the loop is retests: you go back, check whether findings were fixed, and record a retest, which moves the finding's verification state (see Clone and retest). A later milestone report states the new verification state, and the Panel surfaces what still needs attention across all your engagements. That is the whole cycle, from an empty install to a delivered, tracked engagement.