Board Exposure
Report
Executive assessment, technical evidence and a clear handover to the people who act.
This excerpt illustrates the structure of a proposed deliverable. No assessment has been performed. It contains no client information, measured scores, findings or claims of compromise.
The evidence behind the decision.
Each engagement agrees scope, authorisation, methods, evidence handling and decision ownership before assessment begins. The report retains those boundaries.
- Scope & authority
- Named assets, ownership or permission, authorised methods, exclusions, dates, contacts and stop conditions.
- Executive position
- Business context, material observations, confidence, limitations and the decisions requiring an accountable owner.
- Technical evidence
- Observation, source and time, affected asset, collection method, confidence and required validation. An indicator is not proof of compromise.
- Control priorities
- Proposed control, rationale, owner, relative priority, dependencies and acceptance evidence. Proposed controls remain separate from implemented controls.
- Remediation handover
- A defined brief for the client’s team or chosen partner. Implementation and any intrusive testing require separate scope and authority.
- Reassessment
- Evidence needed for closure, unresolved questions, residual risk owner and changes that would trigger a fresh review.
The next decision
Agree which assets and questions the assessment should cover, who can authorise the work and what evidence the board and delivery team need.