A formal report used to document observed or suspected security issues related to information systems or technology.