Illustrative sample · Fictional data throughout
WISP &
Security Gap Review
Selected plan claims. Reviewed evidence. Practical next actions.
An example of the report format, not a real client engagement or a compliance verdict.
Overview · Fictional example
What this review tells the owner
The supplied records support some narrow observations: accounts and roles are listed, MFA methods are registered, and a backup job is shown. They do not establish whether every plan claim is implemented. The next steps focus on confirming access needs, MFA enforcement and backup coverage.
Agreed scope in this example
An existing written information security plan (WISP), up to 25 users and one Microsoft 365 tenant. Selected claims are compared with account access, former-user, administrator-role, MFA and backup evidence.
Three kinds of evidence
- Observed
- Shown in supplied records; limited to those records. All records described here are fictional.
- Self-reported
- Described by the owner or provider without supporting evidence reviewed.
- Unverified
- Evidence was insufficient or unavailable. This does not establish that a control works or has failed.
Finding 01 · Fictional example
Former-user access & administrator roles
Review status: Purpose and need unverified
- What the plan says
- Access is removed when staff leave, and administrator privileges are limited to business need.
- Observed evidence
- A supplied account export lists an enabled account. A role export lists two accounts with Global Administrator privileges.
- Self-reported information
- The owner identifies the enabled account as belonging to a former employee.
- Gap or uncertainty
- The account's current purpose and the business need for each administrator assignment were not documented. An enabled account alone does not establish that anyone used it after departure.
Priority & next action
Confirm promptly: the account may no longer need access, and administrator roles carry broad privileges.
Ask the IT provider to confirm the account's purpose and the reason for each administrator assignment. Any access changes are separate work.
Finding 02 · Fictional example
Administrator MFA
Review status: Enforcement unverified
- What the plan says
- Administrator accounts require MFA.
- Observed evidence
- An MFA registration report lists methods for the administrator accounts shown.
- Self-reported information
- No separate owner or provider statement is used in this example.
- Gap or uncertainty
- Enforcement policy and sign-in evidence were not supplied. Registration does not confirm enforcement; missing evidence does not show that MFA is absent.
Priority & next action
Verify promptly because these accounts have administrative privileges.
Request the applicable MFA policy and supporting sign-in evidence from your IT provider.
Finding 03 · Fictional example
Backup and restore evidence
Review status: Coverage and recovery unverified
- What the plan says
- Business records are backed up and restores are tested.
- Observed evidence
- A dashboard shows a successful backup job for one listed source.
- Self-reported information
- The owner reports that restore tests have taken place.
- Gap or uncertainty
- Full coverage could not be established from the supplied material, and no restore-test record was supplied. Missing test evidence does not show that a restore failed. No live restore was performed.
Priority & next action
Follow up on coverage and recovery evidence before relying on the plan's claim.
Ask your IT provider to compare covered sources with the intended records and supply existing restore-test documentation. Any new test is separate work.
Owner walkthrough · Fictional example
Turn the findings into decisions
The $299 review includes a prioritized written report and a 30-minute owner walkthrough. Use that conversation to understand the evidence, the uncertainties and which follow-up questions matter first. You keep the report and choose who handles any follow-up work.
Review limits
Findings reflect the agreed scope and available evidence. The review makes no system changes. It excludes remediation, individual workstation inspections, live restore tests, penetration testing, full WISP creation or rewriting, comprehensive audits and compliance certification.
Missing evidence is not proof of failure. Backup job evidence is not a live recovery test. This sample is illustrative throughout; it contains no real client data or findings.
Free fit conversation. Eligibility, scope, access and timing are agreed before payment. No obligation to buy managed IT.