Illustrative sample — fictional informationThis is not a client report, a testimonial, or the result of a real assessment. The organization, assets, observations, and priorities below are invented to demonstrate the report format. Actual findings depend on the agreed checks and evidence available.
BUSINESS SECURITY ASSESSMENTExample business · findings summary
Illustrative environment: 10 user accounts, 10 Windows workstations, one Microsoft 365 tenant, and one office. This excerpt illustrates three findings; it is not a complete assessment checklist.
What the owner needs to know
The example review identifies gaps in administrator sign-in protection, workstation updates, and evidence of backup recovery testing. Start with administrator access, then coordinate updates and a separately scoped recovery test with the responsible IT provider.
How to use the report: agree on owners and timing, carry out authorized changes, and collect evidence that the issues have been addressed. Ratings reflect the circumstances in this fictional example; they are not standardized vulnerability scores.
Priority 1 · High
Administrator sign-in protection needs attention
- What was reviewed
- Sample administrator-role inventory and available MFA settings.
- Illustrative observation
- One of two administrator accounts has no demonstrated MFA enforcement. The example evidence lists the account, assigned role, and relevant sign-in policy.
- Why it matters to the business
- A compromised administrator account could allow changes to email, user access, and sharing settings across the organization.
- Recommended next step
- Have the authorized administrator review available sign-in protections and enforce suitable MFA. Confirm recovery access and test the change before expanding it.
- Owner and verification
- Client administrator or IT provider. Review the applied policy and a controlled sign-in test, then record the result. A separate implementation scope governs any changes made by Purpstar.
Priority 2 · Medium
Two workstations have overdue security updates
- What was reviewed
- Sample device inventory and operating-system update status.
- Illustrative observation
- Two of ten workstations show missing updates against the example business’s agreed update schedule. A full findings appendix would identify the devices and relevant updates.
- Why it matters to the business
- Delaying security updates can leave known weaknesses open on computers used for daily work.
- Recommended next step
- Confirm the applicable updates and any compatibility concerns with the software vendor or IT provider. Schedule installation, required restarts, and checks of business applications.
- Owner and verification
- Client IT provider. Recheck update status after installation and confirm that affected business applications still work. Update installation is separate from the assessment.
Priority 3 · Medium
Recovery readiness has not been demonstrated
- What was reviewed
- Sample backup coverage, retention settings, and the documented recovery process.
- Illustrative observation
- Backups are configured, but no recent restore-test record was supplied. This means recovery has not been demonstrated by the reviewed evidence; it does not prove the backups have failed.
- Why it matters to the business
- The owner needs to know whether important files can be recovered and whether the process meets operational needs.
- Recommended next step
- Agree on a representative restore test with the backup provider, using a safe test location. Confirm required data, permissions, and expected recovery needs before starting.
- Owner and verification
- Client backup owner and IT provider. Keep a record of what was restored, its integrity, the time required, and any gaps. The restore test requires a separate authorized scope.
Your next steps, in order
- Confirm the sign-in gap and agree on a controlled administrator-protection change.
- Schedule the affected workstation updates and verification.
- Plan an authorized restore test and document the result.
The results meeting explains priorities, answers questions, and confirms who will own the next actions. Implementation, ongoing reviews, and retesting are included only when expressly agreed in your quote.
What an actual engagement adds
Your report identifies the real systems reviewed, the assessment methods and limitations, evidence behind the findings, and recommendations specific to your business. A point-in-time assessment does not guarantee threat prevention or provide continuous monitoring, incident response, or compliance certification.
Review Assessment Scope & Pricing →