Independent assessment practice

The deliverable

What the report contains.

Every assessment ends in one document. This page is that document taken apart: its structure, what each section is for, the severity language used inside it, and two findings worked end to end. This page also prints as the sample document.

Start an inquiry What gets examined

01

Anatomy

The eight parts

Each part exists to answer a question the reader will otherwise have to ask. The right-hand note says why it is there.

  1. Cover and scope statement

    What was in scope, what was explicitly excluded, the assessment window, and the access that was granted.

    A finding is only meaningful against a stated boundary. The reader should never have to guess what was not looked at.

  2. Executive summary

    The material conclusions in plain language, ordered by what deserves attention first.

    Written to be read by someone who will not read the rest, and to survive being forwarded.

  3. Findings register

    Every finding on one page: identifier, severity, affected system, and title.

    The page that gets turned into a remediation plan.

  4. Findings

    One sheet per finding — condition, evidence, impact, remediation.

    The evidence is included so the finding can be verified independently, not taken on trust.

  5. Observations

    Items that are not findings: things worth recording, deferred decisions, and conditions that may matter later.

    Not everything worth saying is a defect. Inflating observations into findings devalues the severity scale.

  6. Method and coverage

    What was examined, how, and against which references — and what was not covered.

    Stating coverage limits is what separates an assessment from an assurance claim.

  7. Closeout

    Confirmation that assessment access was removed and working evidence destroyed.

    The engagement ends on the record, not by going quiet.

  8. Signature

    Signed by the responsible practitioner who performed the work.

    One person examined it and one person is accountable for it.

02

Severity

How severity is decided

Severity describes exposure in the environment that was assessed. It is not a vendor score, and it is not adjusted to make a report look more urgent than the evidence supports.

Critical

An exploitable path to tenant-wide administrative control, or data exposed to unauthenticated access. Act before the next change window.

High

A control gap that materially increases the likelihood or the blast radius of a compromise. Act on a defined schedule.

Medium

A weakness that requires other conditions to be exploitable, or that degrades detection and response.

Low

A hardening opportunity with no immediate exposure. Recorded so the decision to accept it is deliberate.

Where a finding maps cleanly to the CIS Microsoft 365 Benchmark, CISA SCuBA, or NIST CSF 2.0, the reference is cited alongside it. Where it does not, the finding stands on its own evidence rather than being forced into a control identifier.

03

Worked finding

Two findings, as delivered

The register row each finding occupies, then the sheets themselves. The first sheet is annotated in the margin with what each field is doing; the second appears exactly as a client receives it.

Illustrative findings / synthetic lab data / not client work

IAM-01

High

Microsoft Entra ID

Standing Global Administrator assignments increase privileged-access exposure

IAM-02

Medium

Microsoft Entra ID

Unowned application registration holds a long-lived client secret

Kino Security / illustrative assessment finding

Microsoft Entra ID / IAM-01

Finding ID IAM-01
Severity High
Affected system Microsoft Entra ID

Standing Global Administrator assignments increase privileged-access exposure

Condition

Four direct Global Administrator role-assignment schedule instances are active in the illustrative tenant with no end date. The assignments provide standing tenant-wide administrative capability rather than requiring time-bound activation for routine privileged access.

States what was observed and nothing else. No adjectives, no inference, no recommendation — a sentence the client can verify or disprove in their own tenant.

Evidence
Evidence excerpt / Microsoft Graph v1.0 / synthetic lab output
GET /v1.0/roleManagement/directory/roleAssignmentScheduleInstances
    ?$select=principalId,roleDefinitionId,directoryScopeId,
             startDateTime,endDateTime,assignmentType,memberType

HTTP/1.1 200 OK
{
  "value": [
    {
      "principalId": "1f3b········a821",
      "roleDefinitionId": "62e90394-69f5-4237-9190-012177145e10",
      "directoryScopeId": "/",
      "startDateTime": null,
      "endDateTime": null,
      "assignmentType": "Assigned",
      "memberType": "Direct"
    },
    {
      "principalId": "6d92········11be",
      "roleDefinitionId": "62e90394-69f5-4237-9190-012177145e10",
      "directoryScopeId": "/",
      "startDateTime": null,
      "endDateTime": null,
      "assignmentType": "Assigned",
      "memberType": "Direct"
    },
    {
      "principalId": "8a40········c704",
      "roleDefinitionId": "62e90394-69f5-4237-9190-012177145e10",
      "directoryScopeId": "/",
      "startDateTime": null,
      "endDateTime": null,
      "assignmentType": "Assigned",
      "memberType": "Direct"
    },
    {
      "principalId": "c251········9d37",
      "roleDefinitionId": "62e90394-69f5-4237-9190-012177145e10",
      "directoryScopeId": "/",
      "startDateTime": null,
      "endDateTime": null,
      "assignmentType": "Assigned",
      "memberType": "Direct"
    }
  ]
}

The query and its response, so the finding can be reproduced rather than believed. Identifiers are truncated to what is needed to act.

Impact

Standing Global Administrator access increases the number of identities capable of making high-impact tenant changes at any given time. Compromise of one of those identities may provide immediate administrative capability without a separate privilege-elevation event.

Why the condition matters in this environment. Written for the person who approves the remediation budget, not for another engineer.

Remediation

Review each standing assignment and document its operational requirement. For routine administrative identities, prefer eligible, time-bound Privileged Identity Management activation with strong authentication and approval controls where appropriate.

Retain standing Global Administrator access only where a documented exception requires it, such as a deliberately governed emergency-access account, and apply compensating monitoring and access controls.

Specific enough to act on, and it names the legitimate exception. Guidance that ignores why the condition exists gets ignored in turn.

Assessment note: This specimen uses synthetic lab data formatted to mirror Microsoft Graph role-assignment schedule output. It is illustrative only and is not an anonymized client finding.

Delivered form / no annotations

Kino Security / illustrative assessment finding

Microsoft Entra ID / IAM-02

Finding ID IAM-02
Severity Medium
Affected system Microsoft Entra ID

Unowned application registration holds a long-lived client secret

Condition

The application registration “svc-reporting-sync” has no assigned owner and holds one client secret with a validity period of approximately two years. The corresponding service principal is assigned the application permission Mail.Read.

Evidence
Evidence excerpt / Microsoft Graph v1.0 / synthetic lab output
GET /v1.0/applications(appId='7c1e········44f9')
    ?$select=displayName,passwordCredentials

HTTP/1.1 200 OK
{
  "displayName": "svc-reporting-sync",
  "passwordCredentials": [
    {
      "displayName": "deployment secret",
      "startDateTime": "2025-11-04T00:00:00Z",
      "endDateTime": "2027-11-04T00:00:00Z"
    }
  ]
}

GET /v1.0/applications(appId='7c1e········44f9')/owners

HTTP/1.1 200 OK
{ "value": [] }

GET /v1.0/servicePrincipals(appId='7c1e········44f9')/appRoleAssignments

HTTP/1.1 200 OK
{
  "value": [
    {
      "resourceDisplayName": "Microsoft Graph",
      "appRoleId": "810c········9f9c",
      "principalType": "ServicePrincipal"
    }
  ]
}
Impact

A long-lived secret on an unowned registration has no one accountable for its rotation, storage, or revocation. If the secret is exposed — through a build log, a configuration file, or a departing administrator's notes — there is no owner positioned to notice or respond, and the Mail.Read permission grants the bearer access to mail content across the tenant until the secret expires.

Remediation

Assign at least two accountable owners to the registration. Replace the client secret with a certificate credential or a federated identity credential where the hosting workload supports it, and set a deliberate rotation window with expiry alerting. Review whether Mail.Read at application scope remains necessary for the stated purpose, and reduce or re-consent the permission if it does not.

Assessment note: This specimen uses synthetic lab data formatted to mirror Microsoft Graph application, owner, and permission assignment query output. It is illustrative only and is not an anonymized client finding.

Start an inquiry Back to the practice