Offsite server copies are configured
13 of 14 sampled offsite runs succeeded first time; the failed run succeeded the following day. This confirms job reporting, not restore capability.
Full illustrative assessment · Fictional business
See what a practical
IT assessment delivers.
A connected review of security, networks, backups, recovery, and infrastructure for a 40-person office.
Download the full 15-page report (PDF)A demonstration, not a client report
Example Office Co. is fictional. All people, assets, exports, observations, and results are invented to demonstrate report quality. No systems were accessed or tested to create this sample. A customer assessment follows its own agreed scope.
40employees
12findings
4 / 6 / 2high / medium / low
30 / 60 / 90day roadmap
01 / Executive summary
Useful foundations. Important gaps to resolve.
This office has Microsoft 365, an IT provider, endpoint protection, and offsite backup jobs. The priorities are privileged access, guest-network separation, backup administration, and proving recovery.
No breach is asserted. Four high-priority findings need prompt attention or validation. A missing restore record is an uncertainty to resolve, not proof that the backups will fail.
Most staff and endpoints have baseline controls
38 of 40 staff accounts are covered by MFA enforcement; 36 of 40 endpoints have recent protection telemetry. Exceptions remain in scope.
Remote access uses a VPN service
The reviewed firewall rules show no direct internet forwarding to Windows RDP. VPN authentication and access scope still require appropriate review.
Some operational safeguards are in place
The customer has an IT provider, a UPS, and available equipment records. UPS runtime under load was not tested.
Business decision: approve the initial access and recovery work before committing to a server purchase. Use the findings to guide your existing provider or separately scoped remediation.
02 / Scope and environment
A realistic office, reviewed as one environment.
One Ontario location, 40 employees, one Microsoft 365 tenant, and two local server VMs. Illustrative review period: October 12-16, 2026. Report date: October 17, 2026.
| Area | Environment | Evidence boundary |
|---|---|---|
| People & endpoints | 40 employees; 36 laptops and 4 desktops | All 40 listed; 36 security agents current, 4 stale |
| Microsoft 365 | 40 user licenses; 2 named admins; 1 shared legacy admin | One tenant; 38/40 staff covered by MFA enforcement |
| Local servers | 1 physical host; 2 virtual servers | Directory services and shared files; approximately 1.2 TB file data |
| Network | 1 firewall; 2 managed switches; 3 access points | Staff and guest SSIDs; one business internet circuit |
| Backup & power | 1 NAS repository; offsite copy service; 1 UPS | Nightly server jobs; UPS self-test status only reviewed |
Read-only review in this scenario: interviews, exported settings, inventories, and existing records. No active scanning, penetration testing, full device inspection, restore test, UPS load test, or configuration change is represented.
Recovery goals proposed by management: shared files available within four hours (RTO); no more than one working day of lost file changes (RPO). These are desired outcomes, not verified capabilities or contractual commitments.
03 / Findings and evidence
Understand the issue. See the next step.
High: material exposure or a critical recovery uncertainty needing prompt attention. Medium: a meaningful reliability or control gap. Low: a lower-priority planning or documentation improvement. These are contextual priorities, not scanner scores or certification grades.
Effort bands are illustrative consultant labour, not elapsed time or a quote. Licensing, procurement, customer participation, and maintenance windows may add time.
HighF01 / A shared privileged account is outside MFA enforcement
Identity & security · Configuration observed; no account compromise established
- Observed evidence (fictional)
- E02: Three standing privileged cloud accounts were listed: two named administrator accounts and one shared legacy administrator. Policy review showed the shared account excluded from MFA enforcement. No approved emergency-access procedure was provided.
- Business impact
- A compromised privileged password could allow changes to accounts, security settings, or business data. Shared use also makes actions harder to attribute.
- Recommended action
- Confirm account ownership and dependencies. Move routine administration to named separate accounts, reduce standing privileges, and design monitored emergency access with appropriate controls before removing legacy access.
- Owner
- IT provider + business owner
- Indicative effort
- Small: 0.5-1 day
- Recommended timing
- Prompt review; first 30 days
- Dependencies
- Authorized access, licensing review, recovery-access plan
- Validation / closure evidence
- Test named administrator sign-in and recovery access in a controlled session. Confirm routine privileged access requires the intended controls; retain an agreed recovery route.
HighF02 / Guest Wi-Fi shares the business network
Network & Wi-Fi · Configuration observed; traffic paths not tested
- Observed evidence (fictional)
- E03: The three access points map the guest and staff SSIDs to the same VLAN. The exported configuration shows no guest isolation control. No active reachability test was performed.
- Business impact
- A guest device may have network access toward business devices. Actual permitted paths still require validation; the configuration does not demonstrate separation.
- Recommended action
- Define guest internet-only access, identify any legitimate exceptions, and plan a separate VLAN with firewall rules. Schedule the change and preserve management access.
- Owner
- Network consultant + IT provider
- Indicative effort
- Medium: 1-2 days
- Recommended timing
- First 30 days, after design approval
- Dependencies
- Switch/AP support, VLAN plan, maintenance window, rollback copy
- Validation / closure evidence
- From an authorized test device, confirm internet works and access to staff, server, and management networks is denied as intended. Validate staff printing and file access separately.
HighF03 / One credential can administer production and local backups
Backups & security · Shared administrative exposure observed; offsite protection unverified
- Observed evidence (fictional)
- E04/E05: The same named administrator is used for host administration and NAS administration. The local backup repository is on that NAS. Offsite copy jobs appear in the console, but deletion protection was not verified.
- Business impact
- Compromise of this credential could affect production and its local recovery copies. Offsite deletion resistance must be checked before relying on it as an independent recovery layer.
- Recommended action
- Separate administrative identities and permissions for backup management. Review offsite retention locks, deletion rights, recovery credentials, and alerting with the backup provider.
- Owner
- Backup provider + IT provider
- Indicative effort
- Medium: 1-2 days
- Recommended timing
- First 30 days
- Dependencies
- Backup vendor access, supported permissions, approved access transition
- Validation / closure evidence
- Review effective permissions and approved recovery access. Verify protection settings and a safe restore path; do not attempt destructive deletion testing in production.
HighF04 / The desired recovery time has not been demonstrated
Recovery & continuity · Recovery capability not verified; high validation priority
- Observed evidence (fictional)
- E01/E04/E07: Management requested file access within four hours and no more than one working day of data loss. Server jobs run nightly. No completed full-server restore exercise or timed recovery record was provided.
- Business impact
- Nightly jobs may align with the proposed data-loss tolerance if successful, but there is no evidence the four-hour recovery goal can be met. Missing evidence does not prove recovery will fail.
- Recommended action
- Confirm the business recovery objectives and outage scenarios. Separately scope a restore exercise with an isolated destination, recovery sequence, acceptance checks, and named decision makers.
- Owner
- Business owner + recovery consultant
- Indicative effort
- Medium: 1-3 days for a separately scoped exercise
- Recommended timing
- Plan in 30 days; exercise by 60 days
- Dependencies
- Approved targets, storage/compute capacity, credentials, test data handling
- Validation / closure evidence
- Record the actual recovery point, elapsed recovery time, application/file checks, and limitations. Compare results with approved objectives and update the plan.
MediumF05 / Four computers have stale protection status
Endpoint security · Reporting gap observed; local device state unverified
- Observed evidence (fictional)
- E06: Protection inventory contains 40 devices; four last reported more than 14 days before the sample review. The other 36 reported within 24 hours. These four devices were not examined directly.
- Business impact
- The console cannot establish current protection for those devices. They may be offline, retired, or experiencing an agent issue; they are not assumed to be unprotected or infected.
- Recommended action
- Reconcile the four device records against staff and asset ownership. Inspect active devices, correct reporting failures, and retire stale records only after confirmation.
- Owner
- IT provider + office manager
- Indicative effort
- Small: 0.5-1 day
- Recommended timing
- First 30 days
- Dependencies
- Device access, staff availability, asset ownership
- Validation / closure evidence
- Confirm each active device reports current agent health and its assigned security policy. Record the disposition of retired devices.
MediumF06 / Server update installation and restart ownership are unclear
Patching & systems · Pending state observed; vulnerability exploitation not assessed
- Observed evidence (fictional)
- E05/E07: Both guest-server update reports show pending security updates and a required restart. The provider supplied no completed monthly patch checklist or exception approval for the reviewed period.
- Business impact
- Updates may remain unapplied longer than intended. A pending restart can delay activation of fixes. No exploitation or specific vulnerability exposure was established.
- Recommended action
- Agree the update owner, maintenance window, dependency checks, and restart process. Review current vendor advisories before prioritizing the actual deployment.
- Owner
- IT provider + application owner
- Indicative effort
- Small: 0.5-1 day, subject to preflight
- Recommended timing
- First 30 days; earlier if advisory review requires
- Dependencies
- Application support, backup checks, access, outage approval
- Validation / closure evidence
- Confirm installation results, restart completion, service health, and the next reporting date. Record failed updates or approved exceptions.
MediumF07 / One aging host carries both local server roles
Infrastructure refresh · Single-host dependency observed; no immediate failure predicted
- Observed evidence (fictional)
- E05/E08: One six-year-old physical host runs the directory-services VM and file-server VM. No second recovery host is recorded. Warranty expiry is shown as May 2027. No hardware fault was reported.
- Business impact
- A host failure could interrupt local sign-in services and shared files until repair or restore. Age alone does not prove replacement is urgent; workload dependency and recovery options drive the decision.
- Recommended action
- Compare retaining with support and a proven recovery route, replacing the host, and retiring suitable local workloads. Assess application, identity, file-access, licensing, and connectivity dependencies first.
- Owner
- Business owner + infrastructure consultant
- Indicative effort
- Small: 1 day for options; delivery quoted separately
- Recommended timing
- Options by 60 days; approve a plan by 90 days
- Dependencies
- Application requirements, budget, warranty verification, recovery test
- Validation / closure evidence
- Approve an option against business needs and lifecycle costs. Separately design and test migration or recovery; do not retire the host until dependencies and rollback are resolved.
MediumF08 / Current network configuration backups are incomplete
Network recovery · Documentation and backup-process gap observed
- Observed evidence (fictional)
- E03/E07: Current read-only exports were obtained for the firewall, two switches, and three access points. The customer had no retained switch or AP configuration copy before the review; its firewall copy was 11 months old.
- Business impact
- Replacement or rollback may depend on manual reconstruction and provider availability. The new assessment exports help, but an operational backup and retention process is still needed.
- Recommended action
- Establish secure configuration export/storage, version labels, an owner, and a cadence after changes. Maintain an access route that does not depend entirely on the failed equipment.
- Owner
- IT provider
- Indicative effort
- Small: 0.5-1 day
- Recommended timing
- By 60 days
- Dependencies
- Secure storage, vendor procedures, privileged access restrictions
- Validation / closure evidence
- Confirm authorized staff can retrieve the right version and follow a vendor-supported restoration procedure. A live restore requires separate approval.
MediumF09 / Cloud recovery coverage is not mapped to business needs
Microsoft 365 recovery · Coverage not verified against requirements
- Observed evidence (fictional)
- E02/E07: Microsoft 365 recycle-bin/versioning capabilities are in use. No approved recovery coverage matrix, separately configured backup policy, or restore-test evidence was supplied for Exchange, SharePoint, and OneDrive.
- Business impact
- Native recovery features provide useful protection, but the business has not established whether their scope, history, and restoration process meet its scenarios. This is not a claim that Microsoft 365 has no recovery capability.
- Recommended action
- Document deletion, ransomware, departed-user, and bulk-recovery scenarios. Review applicable native capabilities and compare additional backup options only where a justified gap remains.
- Owner
- Microsoft 365 provider + business owner
- Indicative effort
- Small: 0.5-1 day for review
- Recommended timing
- By 60 days
- Dependencies
- Tenant access, license/capability review, business retention requirements
- Validation / closure evidence
- Record coverage, permissions, retention assumptions, and a separately agreed sample restore. Confirm exclusions and objectives with management.
MediumF10 / Backup alerts have no named backup owner
Monitoring & operations · Routing observed; response process not evidenced
- Observed evidence (fictional)
- E04/E07: Failed-job notifications target one provider mailbox. No escalation contact or documented holiday cover was supplied. A failed offsite job on October 7 was followed by success on October 8; no impact investigation record was available.
- Business impact
- An alert may be delivered without timely action. The sampled recovery point recovered after retry, but the review cannot establish consistent response or coverage.
- Recommended action
- Assign a primary and alternate owner, define expected response and escalation, and include backup and device-health checks in a short operating checklist.
- Owner
- IT provider + office manager
- Indicative effort
- Small: 0.5 day
- Recommended timing
- First 30 days
- Dependencies
- Named contacts, agreed responsibilities, supported notification test
- Validation / closure evidence
- Use a vendor-supported test notification; confirm receipt, acknowledgement, escalation, and evidence retention without intentionally failing production backups.
LowF11 / The environment diagram and provider contacts need updating
Documentation · Outdated records observed
- Observed evidence (fictional)
- E07: The supplied diagram predates the current firewall and contains one retired switch. Provider contact information names a former account representative. A current assessment overview was drafted from the reviewed exports.
- Business impact
- Routine changes and incident handover may require avoidable rediscovery. There is no evidence that documentation has already caused an outage.
- Recommended action
- Validate the overview, update vendor contacts and responsibilities, and assign an owner to maintain the records after changes.
- Owner
- Office manager + IT provider
- Indicative effort
- Small: 0.5 day
- Recommended timing
- By 90 days
- Dependencies
- Provider confirmation, approved document storage
- Validation / closure evidence
- Have the provider and office manager confirm the diagram and contact list. Keep a securely accessible offline copy of recovery contacts.
LowF12 / Equipment ownership and renewal dates are incomplete
Asset lifecycle · Inventory completeness gap observed
- Observed evidence (fictional)
- E08: The asset spreadsheet lists all 40 computers, but seven lack an assigned owner and warranty dates are missing for both switches and three access points. Serial numbers were not independently reconciled on every device.
- Business impact
- Budgeting, replacement planning, and support entitlement checks are harder. Missing fields do not mean equipment is unsupported.
- Recommended action
- Confirm ownership and support dates, record renewal contacts, and build a simple annual replacement forecast linked to business criticality.
- Owner
- Office manager + purchasing contact
- Indicative effort
- Small: 0.5-1 day
- Recommended timing
- By 90 days
- Dependencies
- Purchasing records, vendor entitlement access
- Validation / closure evidence
- Reconcile missing fields with purchasing records and provider/vendor records. Review the inventory quarterly and after significant changes.
04 / Prioritized roadmap
A sequence the business can manage.
Urgent new evidence is escalated immediately. The roadmap is a proposed schedule; approvals, dependencies, budget, and findings from validation can change it.
Prompt / first 30 days
F01-F06, F10
Review privileged access and recovery access first; assign alert ownership; reconcile endpoints; plan guest separation and server updates. Agree recovery objectives and the restore exercise.
Business owner approves; IT provider leads changes. Critical new evidence is escalated immediately.
By 60 days
F04, F07-F09
Perform the separately approved restore exercise; compare host refresh options; establish configuration backups; map cloud recovery requirements.
Depends on safe test capacity, application support, and the access-control changes.
By 90 days
F07, F11-F12; recheck all
Approve the infrastructure direction, validate completed changes, update documentation and asset records, and close findings only with evidence.
Larger migrations may continue beyond 90 days under a separate project plan.
Optional projects, separately agreed.
The assessment identifies what to improve. Restore exercises, detailed migration design, procurement, and implementation require an approved scope, fee, and schedule.
Identity and network hardening
Related findings: F01-F03, F05-F06
Named admin access, guest separation, backup privilege separation, and endpoint/update corrections.
Before implementation: Approved design, maintenance window, configuration snapshots, validation and rollback.
1-4 delivery days across agreed windows; final scope required.
Recovery validation and planning
Related findings: F04, F08-F10
Isolated server restore exercise, cloud recovery coverage review, configuration backup process, escalation checklist.
Before implementation: Approved test destination, representative data, business acceptance criteria; no live overwrite.
2-4 days, dependent on restore duration and scope.
Infrastructure refresh options and delivery
Related findings: F07, F11-F12
Compare host replacement, supported retention, and selective cloud migration. Detail the chosen route only after discovery.
Before implementation: Application compatibility, identity/file dependencies, licensing, procurement, migration and rollback plan.
Options review about 1 day; implementation separately designed and quoted.
05 / Evidence and review meeting
Traceable observations. Clear limitations.
Evidence references below describe invented sample records. In a real engagement, sensitive exports are handled under the agreed access and evidence arrangements, rather than published in a public report.
| ID | Sample evidence | Coverage |
|---|---|---|
| E01 | Management interview notes | Working-hours impact, priorities, proposed recovery targets |
| E02 | Identity and Microsoft 365 exports | Accounts, policy assignments, licenses, recovery settings |
| E03 | Network configuration exports | Firewall, switches, APs; no active traffic/path testing |
| E04 | Backup console records, October 3-16 | Job history, repositories, retention settings; no restore |
| E05 | Host and guest inventory/update exports | VM placement, hardware, storage, pending updates |
| E06 | Endpoint security status export | 40-device status snapshot; no forensic analysis |
| E07 | Provider interview and supplied records | Responsibilities, recovery notes, configuration history |
| E08 | Asset register and purchase records | Ownership, age, support dates; not a physical stocktake |
The findings meeting confirms the priorities, owners, accepted risks, access limitations, and next steps. A finding closes when the agreed evidence demonstrates the action is complete; a purchased product alone is not closure.
General methodology references: Canadian Centre for Cyber Security - baseline controls · Microsoft Learn - Microsoft 365 Backup FAQ. These inform the approach; this sample is not a formal audit, compliance opinion, security certification, or guarantee of recovery.
Your environment. Your priorities.
Get a plan built around your business.
Start with a free introductory call. The assessment scope, deliverables, and fixed fee are agreed before paid work begins.
Request a free introductory call