Sample deliverable

See what a usable security record contains.

This example shows how an observation becomes a decision, an action and a record of what was checked. Actual findings and deliverables depend on the agreed engagement.

Security review and action record

Illustrative template

Section A — Scope and coverage

Systems included; questions reviewed; dates; methods; unavailable evidence; exclusions.

Systems included & questions reviewed: Records the exact applications, accounts, networks or workflows within the agreed boundary.

Dates & methods: Identifies when the work took place and whether checks were configuration reviews, interviews, or authorized tests.

Unavailable evidence: Notes logs, documentation or settings that could not be inspected during the review window.

Exclusions: Explicitly states systems, vendors and methods outside the agreed scope.

Section B — Finding

Observation; supporting evidence; affected scope; relevant conditions; confidence; practical impact; open questions.

Observation & supporting evidence: States what was observed and references the configuration setting, record or test that demonstrates it.

Affected scope & relevant conditions: Explains which systems or users are involved and what conditions apply.

Confidence & practical impact: Distinguishes a verified issue from a recommendation or a lead requiring further information.

Open questions: Captures operational context to confirm with the system owner before making changes.

Section C — Agreed action

Priority and rationale; owner; proposed change; dependencies; approval; target date.

Priority and rationale: Explains why this action comes first in relation to business operations.

Owner & proposed change: Names who will carry out the change and what configuration or process will be updated.

Dependencies: Lists prerequisite steps, maintenance windows or third-party provider coordination.

Approval & target date: Records the decision-maker authorizing the work and the agreed schedule.

Section D — Verification

Checks performed; result; operating functions checked; remaining exceptions; follow-up owner.

Checks performed & result: Documents how the completed change was tested and what the check showed.

Operating functions checked: Confirms that dependent business workflows continued to operate as expected.

Remaining exceptions: Records any approved exceptions or deferred items.

Follow-up owner: Identifies who maintains the control going forward.

Section E — Management summary

What needs a decision; what is complete; what remains open; what should be reviewed next.

What needs a decision: Highlights choices requiring leadership approval, budget or policy direction.

What is complete: Summarizes verified improvements finished within the engagement.

What remains open: Tracks work in progress and dependencies awaiting action.

What should be reviewed next: Recommends the next logical check or review cadence.

Questions to ask when reviewing a report

Can someone reproduce the observation? Does the proposed action address the stated problem? Who can approve and complete it? What evidence would show the work is finished?

Discuss an assessment Explore security assessments