Reports

Preparing a template

1. Start from your organisation's report in Word (.docx), or in Excel (.xlsx) for Network projects. The Report Template/ folder in the source has eight sample Word templates for PCI and VAPT (Web, API, Mobile, Thick Client).
2. Write each value PMIS should fill in as a placeholder in braces, for example {Client Name}. Word templates are scanned for the literal {…} text, so no highlighting is needed. The one exception is the Tester, Team Lead and Manager contact table, where PMIS writes into the highlighted run of each cell: keep the highlight your template already has there.
3. Keep each placeholder's text together. Don't rename the placeholders in the findings tables. Keep table header rows intact.

How placeholder names are matched

• A name is lower-cased and every run of punctuation or spaces becomes one underscore, so {Client Name}, {client-name} and {CLIENT_NAME} are the same name.
• Project and people placeholders match when the name contains a built-in name below. The first matching rule wins, and an Admin mapping is tried before any built-in rule. For example {Project Start Date} matches Start Date.
• Finding placeholders must match a listed name exactly (after the normalising above).
• A placeholder nothing matches stays in the report as literal text. Generation is not blocked.

Names recognised without mapping

Click a placeholder to copy it. Where several names are listed, any one of them works.

Parameters you can map (Admin)

After upload, an Admin can map each detected placeholder to one of these parameters. A mapping wins over the built-in names. If the mapped parameter has no value for a project, the mapping is skipped and the built-in names are tried; if none match, the placeholder stays as literal text.

Finding placeholders

Used inside the findings tables of a Word template and the finding rows of an Excel template. Each takes its value from the finding and its library entry.

Tables and rows that repeat

PMIS finds these by their content, not by position, and does nothing if the template has no such table.

Compliance status

{Compliance Status} or {Project Status} (any spacing or underscore form) prints Compliant or Non-Compliant in both Word and Excel, from the project’s saved status. A project that is still In Progress prints as Non-Compliant, exactly like one saved as Non-Compliant. When it is alone in its cell or paragraph, the background is green (#92D050) for Compliant and red (#FF0000) for Non-Compliant and In Progress. With no status saved it stays empty and the template background is left as it is. Generating a report never changes the saved status. In Word it also works in headers, footers and the file name.

VA and PT sections (Word, Network)

Wrap content that applies only to vulnerability assessment or only to penetration testing in marker paragraphs. These are control markers, not parameters: they are never listed as fields. Each marker must be the only text in its paragraph, in any letter case:

{#VA}
 ... VA-only paragraphs and tables ...
{/VA}

{#PT}
 ... PT-only paragraphs and tables ...
{/PT}

A VA project keeps the VA blocks, a PT project keeps the PT blocks, and VAPT keeps both. If the activity type is not set, both are kept. Page and section breaks on marker lines are preserved. Excel templates do not use markers: their rows repeat as described above. In Word Network reports, the Scope and Detail Findings headings start on a new page.

Two more optional block pairs work the same way: {#network}...{/network} is kept only for a Cert-In Network project, and {#SCR}...{/SCR} only for an SCR project (Cert-In, PCI or VAPT); each is removed for every other project. A template does not need to contain them, and a block whose closing marker is missing is left as it is, without an error.

Not supported

• Excel text in drawings, headers, footers and comments is not scanned for placeholders.
• Excel reports are only available for Network projects.
• A placeholder not covered on this page is left as literal text. Ask an Admin to map it, or rename it to a listed name.

Uploading and activating (Admin)

1. Open Reports (in the menu for Admins; an Admin can switch it on for other roles in Settings > RBAC, Open the Reports page) and upload the template. Choose a name, the category (VAPT, PCI, CERT-In, ASV), the format (Word or Excel), the activity type from the drop-down, and the effective-from date.
2. PCI and VAPT templates cover Web, API, Mobile, Thick Client and Network. CERT-In offers Network, SCR and Application; Application is one template that serves every project except Network and SCR, which each need their own CERT-In template.
3. Review the detected fields. Add any the detector missed, and map fields to values if the names differ.
4. Activate the template. Projects of the matching category and activity type then use it.

Inactive templates can be deleted from the same page.

Generating a report

1. On the project page, choose Generate report and pick Word, or Excel for Network projects. Generation runs in the background, and the page updates when it finishes.
2. The template is never picked by hand. A project uses the active Word template for its category and Testing Type (newest effective date wins), and is re-pointed automatically if that template is replaced. If none matches, generation names the missing template.
3. Download the file. Download links expire after one hour. Reopening the report history gives fresh links.

Generation is blocked until both of these conditions hold:

• The project has at least one finding, or its compliance status is Compliant.
• Every finding is report-ready: each PoC step has a description and at least one screenshot. Nessus findings on Network projects are exempt. Findings added manually or imported from a file are not exempt.

Each completed generation gets the next version number, 1.1, 1.2 and so on. Failed attempts don't use a number. The file is named after the template's file name pattern, with project values filled in. The project status becomes Completed, and its retention countdown starts.

Issue Log

From the project, export the Issue Log as CSV: one row per finding. An Admin sets which columns appear, and in what order, under Settings. The header row is plain text (no surrounding quotation marks); data cells are quoted, and any cell that starts with =, +, - or @ is prefixed so spreadsheets do not run it as a formula. Findings added manually or imported from a file are included like any other finding of the project.

History and deletion

Every generation is listed in the project's report history with who generated it and when. Admins, and testers on their own projects, can delete a generated report.