Board Exposure
Report
Agreed cyber exposure, technical evidence and a clear handover to the people who act.
This excerpt illustrates the structure of a proposed deliverable. No assessment has been performed. It contains no client information, measured scores, findings or claims of compromise.
The evidence behind the decision.
Each engagement agrees scope, authorisation, methods, evidence handling and decision ownership before assessment begins. The report retains those boundaries.
- Scope & authority
- Named assets, ownership or permission, authorised methods, exclusions, dates, contacts and stop conditions.
- Executive position
- Business context, material observations, confidence, limitations and the decisions requiring an accountable owner.
- Technical evidence
- Observation, source and time, affected asset, collection method, confidence and required validation. An indicator is not proof of compromise.
- Control priorities
- Proposed control, rationale, owner, relative priority, dependencies and acceptance evidence. Proposed controls remain separate from implemented controls.
- Remediation handover
- A defined brief for the client’s team or chosen partner. Implementation and any intrusive testing require separate scope and authority.
- Reassessment
- Evidence needed for closure, unresolved questions, residual risk owner and changes that would trigger a fresh review.
The next decision
Agree which assets and questions the assessment should cover, who can authorise the work and what evidence the board and delivery team need.
An observation needs a decision.
This fictional record shows how a report separates observation, interpretation and action. The reserved example hostname is not a client asset. No observation below was collected from a live system.
- Agreed context
- A customer portal is being reviewed before wider access. The illustrative target is
portal.example.com. - Observation
- A sign-in page is reachable from the public internet. In a real report, this record would link to the authorised collection method, dated evidence and validation status.
- What it means
- Public reachability can be intentional. This observation alone does not establish a vulnerability, unauthorised access or compromise.
- What remains unknown
- Whether public access is required, which authentication controls apply and whether the service is monitored. No login attempt or internal control test is part of this example.
- Owner and next action
- The service owner confirms the intended audience. The client's security team or chosen provider verifies authentication and monitoring under appropriate written authority and scope.
- Decision and closure
- Retain or restrict public access after its business need and controls are verified. Record the decision owner, evidence required for closure and the date for reconsideration.
This record gives the service owner a specific question, a responsible team and the evidence needed to close it. The scope still excludes internal-control assurance and any claim that the system is secure.