// sample report
Sample report: security assessment
This is what your report looks like. This example is for a made-up organisation, Voorbeeld B.V. (120 users, 1 Azure subscription); all figures are made up.
fictitious example
Management summary
The basics are reasonable, but four issues make a break-in through a stolen password likely. Together they can be fixed in half a day. After that come the points on sharing, Defender and backup.
- 4high risk
- 4medium
- 2low
- 41%Secure Score
Findings ordered by risk
| # | Risk | Finding | Area | Effort to fix |
|---|---|---|---|---|
| 1 | High | 4 administrators without MFA | Identity | 1 hour |
| 2 | High | Legacy sign-in methods not blocked | Identity | 2 hours |
| 3 | High | DMARC is set to p=none | 1 hour | |
| 4 | High | Anyone can grant consent to apps | Identity | 30 min |
| 5 | Medium | 12 guest accounts without a recent sign-in | Collaboration | 30 min |
| 6 | Medium | Sharing with anyone with the link is enabled | Collaboration | 1 hour |
| 7 | Medium | Open Defender recommendations, Secure Score 41% | Defender | 4 hours |
| 8 | Medium | No backup of the most important Azure resources | Azure | 4 hours |
| 9 | Low | No sensitivity labels | Data | 1 day |
| 10 | Low | 3 devices not compliant in Intune | Devices | 1 hour |
High
1. Four administrators without MFA
- What I found
- Four accounts with the Global Administrator role sign in with only a password.
- Why it matters
- One leaked password gives full control over email, files and users.
- Fix
- Require MFA for administrators with a Conditional Access policy, preferably phishing-resistant. Exclude and monitor two emergency accounts.
- Who
- Your own administrator, or me as a follow-up assignment.
What else is in the report?
- A one-page management summary
- All findings per area, with risk, explanation and fix
- Quick wins you can pick up straight away
- A roadmap for the coming months
- Appendices with the data and scripts the findings come from
- A presentation of the results for IT and management
// contact
Shall we talk?
Would you like a website, or help with your cloud environment? Request a half-hour introduction and I'll suggest a time. Or send me a message directly.