Direct answer
Retain the finding, affected asset and owner, technical severity, exploitability and exposure context, treatment decision, due date, exception rationale where applicable, remediation action and closure verification. Evidence should make it possible to explain why one vulnerability was treated before another and whether the chosen treatment actually occurred.
Evidence to retain
Finding evidence
Finding identifier and sourceAffected asset/systemSeverity and technical detailsDiscovery and last-seen dates
Prioritisation evidence
Exploitability or known-exploitation contextExternal exposureAsset/business importanceThreat intelligence and compensating controls
Treatment evidence
Accountable ownerTreatment choice and due dateException/acceptance rationaleRemediation or mitigation task
Closure evidence
Verification resultResidual risk or follow-upReopen history if applicableManagement reporting of overdue material exposure
Relevant Cybatar surfaces
Cybatar operating sourcehttps://cybatar.co/platform/exposure-vulnerability-managementCybatar operating sourcehttps://cybatar.co/research/prioritising-known-exploited-vulnerabilitiesCybatar operating sourcehttps://cybatar.co/security-problems/vulnerability-prioritisation-backlog
External guidance
Claim boundary
A recorded treatment does not prove that a vulnerability is eliminated. Verification quality depends on the underlying scanner, test, system change and evidence available.