An excerpt showing the decision, evidence, and actions from one security finding.
Executive summary · illustrative excerpt
Backup copies can be deleted, and recovery is unverified.
The nightly backup jobs succeeded. The same administrator account that runs the business application can also delete its backup copies. No recovery exercise record was supplied.
Why leadership needs to act
A compromised administrator account could remove both the working system and its recovery copies. The records do not establish that recovery would meet leadership’s one-working-day tolerance for disruption.
Decision required
Authorize the IT provider to protect the copies and run a controlled recovery exercise. The application owner defines acceptable downtime and data loss; the managing partner approves closure from the evidence.
Priority
Triage the exposed recovery path today. Complete recovery validation within 30 days.
Limits of this conclusion
The reviewed records cover one application and one review period. A missing recovery record does not establish that recovery would fail. No restore was performed as part of this review.
Security confidence scorecard
This excerpt shows Backup & Recovery only. A full report has one line per reviewed domain. Ratings reflect the reviewed evidence, not a guarantee of security.
One illustrative scorecard line
Domain
Status
Maturity
Control owner
Immediate action
Domain Backup & Recovery
Status Critical Gap
Maturity 1 (scale 0-5)
Control owner Shared (firm and provider)
Immediate action Protect backup copies from production credentials and run a recovery exercise
Status keyDefensibleAt RiskCritical Gap
Ratings and column guide
Status
Defensible means the reviewed evidence supports the control within the agreed scope, at the time of review. At Risk means gaps are present. Critical Gap means the exposure needs immediate attention. A rating is not a guarantee. Insufficient evidence is reported instead of guessing.
Maturity
How the control is managed, on our 0 to 5 scale. In this example, 1 means Initial: ad hoc, undocumented, and dependent on individuals. Maturity describes how the control is managed, not a second verdict on its security.
Control owner
Who holds the control today: the firm, the provider, shared, or unassigned. Unassigned is itself a finding.
Framework reference for the provider: NIST CSF 2.0 PR.DS-11
Evidence reviewed
Thirty days of job reports record successful nightly backups of the main business application. The permissions export shows that the production administrator account can also delete backup copies. The service agreement includes backup operation but assigns nobody responsibility for confirming that a recovery works.
What the evidence does not establish
The records cover one application and one review period. They do not show that the application, its database, and user access can be restored together. No recovery exercise record was supplied, and no restore was performed as part of this review.
Business consequence
Client work and billing depend on this application. Leadership's stated tolerance is one working day of disruption, and the evidence does not establish that recovery could meet it. If the administrator account is compromised, the attacker can delete the working system and its recovery copies in the same session.
Recommended action
The provider configures backup copies that cannot be deleted through the production administrator account, then runs an authorized recovery exercise in an isolated environment. The application owner agrees in advance on acceptable downtime and data loss, checks the restored workflow, and approves the outcome in writing.
Ownership
Accountable: the partner who owns the application. Responsible: the IT provider. Approves closure: the managing partner.
Evidence that closes the finding
A configuration review confirming that production credentials cannot delete the protected copies, and a recovery record naming the backup used, the elapsed time, the data point recovered, the checks performed, any exceptions, and the owner's approval. One successful exercise supports that tested scenario; it does not guarantee every future recovery.
Leadership authorizes the provider to protect the backup copies and run a controlled recovery exercise. The application owner defines acceptable downtime and data loss; the managing partner approves closure after reviewing the evidence.
Today
The provider confirms whether production credentials can delete copies and applies agreed safeguards. An exposed recovery path is triaged the same day, not held for the 30-day milestone.
Within 30 days
The provider runs an authorized recovery exercise. The application owner records the workflow checks, elapsed time, and data recovered. The managing partner reviews the protection and recovery evidence promptly and records closure or remaining actions.
Within 60 days
The application owner and provider document recovery responsibilities, escalation, and acceptance in the service record.
Within 90 days
The managing partner checks that safeguards remain in place, reviews any open actions, and confirms the next exercise date. This follow-up does not defer approval of the initial recovery result.
How the full report is organized
Where to find each answer
The report answers four questions leadership asks. The findings and the appendix are written for the people who will do the work, including your provider.
Are we actually protected, or just busy?
Section 1, the executive findings summary
Are our providers delivering what we pay for?
Section 2, provider commitments compared with delivered service
Where are the gaps, and who owns them?
Section 3, the scorecard, and section 4, the findings
What should leadership fix first?
Section 5, the 30/60/90-day roadmap
The full report
1. Executive findings summary
The bottom line for leadership, and the findings that need a leadership decision before anything else starts.
2. Provider commitments compared with delivered service
What the firm understood it was buying, set beside what the agreement and the records show, and what the difference means.
3. Security confidence scorecard
One line per domain: status, maturity, who owns the control, and the immediate action.
4. Findings
Each finding records the evidence reviewed, what it does not establish, the business consequence, the recommended action, ownership, and the evidence that closes it.
5. 30/60/90-day roadmap
Actions in order, each with an owner and a way to confirm it is done. Medium and Low items are listed after the 90-day column with their target dates.
An appendix records every piece of evidence requested, whether it arrived, and which findings rest on it. A record that was not supplied is reported as a limitation, not as evidence that a control has failed.
Talk through what your report would cover
Tell us which decision or concern prompted your inquiry, and we will discuss scope before agreeing on an engagement.