An illustrative report for a fictional 40-person professional-services firm, built from composite engagements. No real client's information appears here. Your report will have the same shape: what you believed, how we checked, what we found, who owns it, and when to look again.
Last updated October 2026. People are listed by role, never by name.
| What the business believed | Who said it | How we checked | What we found | Owner | Check again |
|---|---|---|---|---|---|
| Every mailbox requires multi-factor sign-in | Owner, confirmed by IT provider | Sign-in report from the email system | Confirmed | IT provider | April 2027 |
| Remote access to shared files requires multi-factor sign-in | Owner | Remote-access settings | Not in place; fixed and re-checked in November | IT provider | May 2027 |
| We can restore from backup within a day | Owner | Most recent restore test | Never tested | Owner, with IT provider | Before January renewal |
| Critical updates are applied within two weeks | IT provider | Update report, last 90 days | Confirmed, two laptops behind | IT provider | January 2027 |
| Everyone uses only approved AI tools | Owner; office manager disagreed | Second conversation and sign-in records | Not the case | Owner | April 2027 |
| Former employees lose access the day they leave | Office manager | Account list against departures | Confirmed | Office manager | April 2027 |
Working as everyone believed, with the proof on file.
Remote access now requires multi-factor sign-in, and the AI tool list is in place.
The backup restore. It has an owner and a date, which is often the most valuable line on the page.
The Security Health Check produces one for businesses with up to 100 people.