1.7 Why the outcomes of cyber security testing must be reported