Sample artifact
Sample Management Report
A client-ready management draft showing executive context, assurance position, priority risk, and evidence-backed next actions.
- Client
- Northstar Health
- Assessment
- CIS Controls v8 readiness
- Audience
- Management
- Status
- Draft for human review
Executive Summary
Northstar Health has a credible security governance foundation, with the strongest evidence around policy ownership and incident response preparation.
The assessment identified priority remediation around MFA coverage evidence, vulnerability remediation SLAs, and incident response follow-up actions. P86-Assess links each conclusion back to questionnaire answers, uploaded evidence, assessor review, and audit activity so the report remains defensible.
Assurance Opinion
Draft opinion: limited assurance until high-priority remediation items are evidenced, reviewed, and accepted by the assessor.
Risk Heatmap
| Severity | Likelihood | Impact | Count | Finding |
|---|---|---|---|---|
| High | Medium | High | 1 | Vulnerability remediation SLA evidence is incomplete |
| Medium | Medium | Medium | 2 | MFA policy/export mismatch; incident response actions need closure evidence |
Priority Actions
- Upload vulnerability remediation evidence showing owners, closure dates, and validation proof.
- Provide MFA export evidence proving enforcement for privileged and remote access users.
- Close tabletop action items and attach completion evidence.
Evidence Appendix
| Evidence request | Status | Uploaded file | AI review | Recommendation |
|---|---|---|---|---|
| Critical vulnerability remediation SLA tracker | Under review | northstar-critical-vulnerability-sla.csv | Partial, 74% | Request refreshed tracker with closure evidence |
| MFA policy export | Under review | northstar-mfa-policy-export.csv | Partial | Compare policy claims with platform enforcement |
Human Review Notice
This sample is an AI-assisted draft. A qualified assessor must confirm all evidence, findings, severity ratings, limitations, and client-facing conclusions before issue.