High prioritySB-01 · Open in this sample
Administrator account lacks MFA
- Example evidence
- Fictional evidence: an account-settings export shows one active email administrator with MFA disabled. No sign-in was attempted.
- Why it matters
- A stolen password could expose email administration and account recovery controls.
- Recommended action
- Enroll the administrator in phishing-resistant MFA supported by the provider, such as a security key or passkey. Test recovery access before enforcing the policy. Review other privileged accounts and remove unnecessary access.
- How to check the result
- Confirm the policy applies to every privileged account, test a fresh sign-in and the approved recovery procedure, and retain a dated settings record.
Example owner: Email administrator
Suggested timing: First agreed change window
Guidance: NIST SP 800-63B-4: Authentication and Authenticator Management, section 3.2.5 ↗Medium prioritySB-02 · Open in this sample
DMARC is monitoring only
- Example evidence
- Fictional evidence: _dmarc.workshop.example contains p=none. Aggregate reports are available but have no assigned reviewer.
- Why it matters
- The domain publishes a monitoring policy, without requesting quarantine or rejection of messages that fail DMARC.
- Recommended action
- Assign an owner for reports, inventory legitimate mail senders, and check SPF/DKIM alignment. Resolve delivery issues before moving to quarantine or reject using a planned rollout.
- How to check the result
- Recheck the DNS record, review aggregate reports, and confirm delivery from each legitimate sender after the change.
Example owner: Email administrator and business owner
Suggested timing: After sender inventory and delivery checks
Guidance: Google Workspace: Set up DMARC ↗Medium prioritySB-03 · Open in this sample
Restore capability is unconfirmed
- Example evidence
- Fictional evidence: backup jobs report success, but the supplied records contain no recent restore test. This does not prove that backups have failed.
- Why it matters
- The business does not have evidence of the time or steps needed to recover critical files.
- Recommended action
- Choose representative critical data and arrange a controlled restore to an isolated location. Protect a backup copy from routine account compromise and document who can recover it.
- How to check the result
- Record the restored files, integrity checks, elapsed time, and any missing dependencies. Have the business owner compare the result with agreed recovery needs.
Example owner: IT or backup provider
Suggested timing: Next planned recovery exercise
Guidance: CISA, MS-ISAC, NSA, and FBI: StopRansomware Guide, page 5 ↗Turn the report into an action list.
- Walk through the findings and confirm business impact, owners, and change windows.
- Agree the first fixes and record any accepted risks or evidence still needed.
- Check the changes against the evidence above and update the action list.
A real engagement includes a walkthrough so the priorities and next decisions are understood.
A scoped first pass cannot establish that every system is secure. Findings reflect the agreed scope and available evidence at the time of a review. Penetration testing, remediation work, formal certification, and a full recovery exercise require a separate scope.
Illustrative sample. Fictional findings. No client data or systems were assessed for this sample.