ILLUSTRATIVE SAMPLE REPORT · 02
Cybersecurity Assessment Report
An example of presenting security observations, business impact and prioritised risk treatment actions.
1. Executive summary
This fictional sample illustrates how a scoped review might document gaps in multi-factor authentication (MFA) coverage, privileged access review, incident preparation and backup recovery evidence. Actual risk ratings require evidence, business context, likelihood and impact analysis.
2. Example risk register
| Observation / risk | Severity | Potential impact | Recommended treatment |
|---|---|---|---|
| MFA coverage has not been confirmed for all users | High | Account takeover and unauthorised access. | Verify coverage and plan an approved MFA rollout, including suitable exceptions and recovery procedures. |
| Privileged accounts lack a documented periodic review | High | Excess access or delayed removal of access. | Inventory admin roles, confirm business need and approve least-privilege changes. |
| Incident contacts and response steps are unclear | High | Slower containment, escalation and recovery. | Document incident roles, contact paths, evidence preservation and escalation steps. |
| Backup recovery evidence is incomplete | Medium | Extended interruption or data loss. | Define recovery priorities and conduct an authorised restore test. |
| Security awareness refresh is overdue | Medium | Greater exposure to phishing and social engineering. | Deliver role-relevant awareness and explain how to report suspicious activity. |
| Policy review dates are not recorded | Low | Guidance may become outdated. | Assign a policy owner and a periodic review schedule. |
3. Prioritised remediation plan
4. Example evidence and reporting approach
A real assessment may document evidence sources reviewed, the review date, the relevant system or policy, limitations, the responsible owner and the status of each recommendation. Sensitive details should be minimised and reports shared only with authorised recipients.
5. Scope and limitations
Actual work is limited to agreed systems, access and evidence. Vulnerability testing is performed only with explicit written authorisation and an agreed test boundary. This sample does not claim that any real environment was assessed and does not replace legal advice or an independent certification audit.
6. Example conclusion
In this fictional scenario, identity protection and incident readiness are the first focus areas. The business would then assign owners and due dates and track each action to closure using appropriate evidence.