SAMPLE REPORT

General Security & Compliance Snapshot

EXECUTIVE SECURITY READINESS REVIEW

PREPARED FOR

Northstar Analytics, Inc.

Fictional SaaS Company • 40 Employees
Demonstration Report • August 2026

Illustrative demonstration only. This sample does not represent an audit, certification, attestation, penetration test, formal gap assessment, or determination of compliance.

01

SAMPLE • DEMONSTRATION ONLY

EXECUTIVE SNAPSHOT

Security posture at a glance.

Northstar Analytics demonstrates several foundational security practices, but gaps in formal governance, privileged-access management, and vendor oversight increase unnecessary operational and compliance risk.

OVERALL POSTURE

Developing

Solid foundations. Important gaps remain.

The organization has implemented MFA, endpoint protection, cloud backups, and basic security ownership. However, several processes remain informal or inconsistently documented. Priority should be placed on privileged access, written security policies, and third-party risk management.

HIGHEST RISK

Privileged Access

Administrator permissions are not reviewed on a defined recurring schedule.

STRONGEST AREA

MFA Coverage

Multifactor authentication is broadly deployed across critical cloud services.

FIRST PRIORITY

Formalize Governance

Establish documented security ownership, policies, and recurring risk review.

02

SAMPLE • DEMONSTRATION ONLY

SECURITY POSTURE

Where the organization stands.

Ratings represent high-level observations based on questionnaire responses and limited contextual review.

Governance & Security Policies

DEVELOPING

Identity & Access Management

DEVELOPING

Data Protection

STRONG

Security Operations

STRONG

Vendor & Third-Party Risk

NEEDS ATTENTION

Incident Response

DEVELOPING

What's already working

MFA enabled for major cloud systems

Endpoint protection centrally managed

Cloud backups performed regularly

Security responsibility assigned

Employee accounts centrally provisioned

Production changes require approval

03

SAMPLE • DEMONSTRATION ONLY

PRIORITY FINDINGS

What deserves attention first.

These findings demonstrate the level of prioritization and practical guidance included in a Verdyan Security Snapshot.

HIGH

Privileged access reviews are informal

Administrative permissions exist across several critical systems, but recurring access reviews are not consistently documented.

Recommended action: Establish quarterly privileged-access reviews with documented approval and removal of unnecessary access.

MEDIUM

Security policies require formalization

Core security practices exist operationally, but several are not supported by approved, version-controlled policies.

Recommended action: Establish a minimum security policy set covering access control, incident response, data protection, and acceptable use.

MEDIUM

Vendor risk reviews are inconsistent

Critical service providers process company information, but security due diligence is not consistently documented.

Recommended action: Establish a lightweight vendor classification and security-review process for critical third parties.

MEDIUM

Incident-response testing is limited

Management has informal incident-response expectations, but no recent documented tabletop exercise was identified.

Recommended action: Conduct and document an annual incident-response tabletop exercise.

04

SAMPLE • DEMONSTRATION ONLY

90-DAY ROADMAP

Turn findings into progress.

The goal of the Security Snapshot is not simply to identify gaps. It is to help leadership understand what should happen next.

FIRST 30 DAYS

Reduce immediate exposure

Review all privileged administrative accounts.
Remove unnecessary or stale access.
Assign ownership for core security policies.
Identify critical third-party vendors.

DAYS 31–60

Formalize the program

Approve baseline security policies.
Establish a vendor-review process.
Document incident-response roles.
Establish recurring access reviews.

DAYS 61–90

Build repeatability

Conduct an incident-response tabletop.
Document a recurring security-risk review.
Begin maintaining security evidence.
Determine whether a formal framework should be pursued.

RECOMMENDED NEXT STEP

Build on the foundation already in place.

Northstar Analytics does not appear to require a complete security-program rebuild. The most valuable next step would be formalizing existing practices, addressing privileged-access oversight, and establishing repeatable governance processes.

TALK WITH THE VERDYAN GROUP →

05