Reports
The document somebody outside your team actually asked for.
The problem
A board, an insurer or a customer asks for a security report. Exporting a findings list as a PDF answers a different question and everybody can tell.
How it works
- Reports are built for a reader: an executive summary that leads with what changed, a compliance readiness view, and an assessment report with the method written out.
- Scheduled delivery honours quiet hours and an outside recipient has to confirm before anything is sent to them.
- Every number in a report is traceable to the records it was counted from.
- An assessment report is signed, and a signature cannot be changed or withdrawn afterwards.
What it does not do
A readiness report says what we can see and what we cannot, per control. It is not an audit and does not claim to be one.