Independent assessment practice

The deliverable

What the report contains.

Every assessment ends in one document. This page is that document taken apart: its structure, what each section is for, the severity language used inside it, and one finding worked end to end.

Start an inquiry What gets examined

01

Anatomy

The eight parts

Each part exists to answer a question the reader will otherwise have to ask. The right-hand note says why it is there.

  1. Cover and scope statement

    What was in scope, what was explicitly excluded, the assessment window, and the access that was granted.

    A finding is only meaningful against a stated boundary. The reader should never have to guess what was not looked at.

  2. Executive summary

    The material conclusions in plain language, ordered by what deserves attention first.

    Written to be read by someone who will not read the rest, and to survive being forwarded.

  3. Findings register

    Every finding on one page: identifier, severity, affected system, and title.

    The page that gets turned into a remediation plan.

  4. Findings

    One sheet per finding — condition, evidence, impact, remediation.

    The evidence is included so the finding can be verified independently, not taken on trust.

  5. Observations

    Items that are not findings: things worth recording, deferred decisions, and conditions that may matter later.

    Not everything worth saying is a defect. Inflating observations into findings devalues the severity scale.

  6. Method and coverage

    What was examined, how, and against which references — and what was not covered.

    Stating coverage limits is what separates an assessment from an assurance claim.

  7. Closeout

    Confirmation that assessment access was removed and working evidence destroyed.

    The engagement ends on the record, not by going quiet.

  8. Signature

    Signed by the responsible practitioner who performed the work.

    One person examined it and one person is accountable for it.

02

Severity

How severity is decided

Severity describes exposure in the environment that was assessed. It is not a vendor score, and it is not adjusted to make a report look more urgent than the evidence supports.

Critical

An exploitable path to tenant-wide administrative control, or data exposed to unauthenticated access. Act before the next change window.

High

A control gap that materially increases the likelihood or the blast radius of a compromise. Act on a defined schedule.

Medium

A weakness that requires other conditions to be exploitable, or that degrades detection and response.

Low

A hardening opportunity with no immediate exposure. Recorded so the decision to accept it is deliberate.

Where a finding maps cleanly to the CIS Microsoft 365 Benchmark, CISA SCuBA, or NIST CSF 2.0, the reference is cited alongside it. Where it does not, the finding stands on its own evidence rather than being forced into a control identifier.

03

Worked finding

One finding, end to end

The same sheet that appears in the report, annotated in the margin with what each field is doing.

Illustrative finding / synthetic lab data / not client work

Kino Security / illustrative assessment finding

Microsoft Entra ID / IAM-01

Finding IDIAM-01
SeverityHigh
Affected systemMicrosoft Entra ID

Standing Global Administrator assignments increase privileged-access exposure

Condition

Four direct Global Administrator role-assignment schedule instances are active in the illustrative tenant with no end date. The assignments provide standing tenant-wide administrative capability rather than requiring time-bound activation for routine privileged access.

States what was observed and nothing else. No adjectives, no inference, no recommendation — a sentence the client can verify or disprove in their own tenant.

Evidence
Evidence excerpt / Microsoft Graph v1.0 / synthetic lab output
GET /v1.0/roleManagement/directory/roleAssignmentScheduleInstances
    ?$select=principalId,roleDefinitionId,directoryScopeId,
             startDateTime,endDateTime,assignmentType,memberType

HTTP/1.1 200 OK
{
  "value": [
    {
      "principalId": "1f3b••••••••a821",
      "roleDefinitionId": "62e90394-69f5-4237-9190-012177145e10",
      "directoryScopeId": "/",
      "startDateTime": null,
      "endDateTime": null,
      "assignmentType": "Assigned",
      "memberType": "Direct"
    },
    {
      "principalId": "6d92••••••••11be",
      "roleDefinitionId": "62e90394-69f5-4237-9190-012177145e10",
      "directoryScopeId": "/",
      "startDateTime": null,
      "endDateTime": null,
      "assignmentType": "Assigned",
      "memberType": "Direct"
    },
    {
      "principalId": "8a40••••••••c704",
      "roleDefinitionId": "62e90394-69f5-4237-9190-012177145e10",
      "directoryScopeId": "/",
      "startDateTime": null,
      "endDateTime": null,
      "assignmentType": "Assigned",
      "memberType": "Direct"
    },
    {
      "principalId": "c251••••••••9d37",
      "roleDefinitionId": "62e90394-69f5-4237-9190-012177145e10",
      "directoryScopeId": "/",
      "startDateTime": null,
      "endDateTime": null,
      "assignmentType": "Assigned",
      "memberType": "Direct"
    }
  ]
}

The query and its response, so the finding can be reproduced rather than believed. Identifiers are truncated to what is needed to act.

Impact

Standing Global Administrator access increases the number of identities capable of making high-impact tenant changes at any given time. Compromise of one of those identities may provide immediate administrative capability without a separate privilege-elevation event.

Why the condition matters in this environment. Written for the person who approves the remediation budget, not for another engineer.

Remediation

Review each standing assignment and document its operational requirement. For routine administrative identities, prefer eligible, time-bound Privileged Identity Management activation with strong authentication and approval controls where appropriate.

Retain standing Global Administrator access only where a documented exception requires it, such as a deliberately governed emergency-access account, and apply compensating monitoring and access controls.

Specific enough to act on, and it names the legitimate exception. Guidance that ignores why the condition exists gets ignored in turn.

Assessment note: This specimen uses synthetic lab data formatted to mirror Microsoft Graph role-assignment schedule output. It is illustrative only and is not an anonymized client finding.

Start an inquiry Back to the practice