A new web application system was purchased from a vendor and configured by the internal development team. Before the web application system was moved into production, a vulnerability assessment was…

Immediate CISO notification via an exception report is reserved for critical or high-severity security incidents, not minor configuration findings discovered in pre-production testing.

End users of the application should not be informed of security configuration details, as disclosure could expose the vulnerability to a wider audience before it is remediated.

The vulnerability resulted from the internal development team's configuration of the application, not a defect in the vendor-supplied software, so the vendor is not the appropriate party to notify.

Because the finding is classified as minor and was discovered before the system entered production, the risk is low and manageable through normal workflow. Routing it to the team lead in a weekly report follows proportional escalation procedures, allowing the development team to remediate it as part of their regular cadence without diverting executive attention unnecessarily.