Technology and Compliance Posture Reports
Does this sound familiar?
Asking your provider to show their work can sound like an accusation, so most people never ask. The question goes unanswered, and you keep trusting your IT on faith. You shouldn't have to ask. The proof should arrive on its own.
Two reports
Every client, every quarter
Every client gets one. Every check in it is mapped to NIST CSF 2.0 and CIS Controls, so the same report answers client, insurer and funder questionnaires.
Sample report · Technology Posture Report
A score out of 100 for where your IT stands, measured against your Baseline Posture Score (the score taken before we take over), so you can see it move from quarter to quarter.
Are your protections actually working?
Would you get back to work if something went wrong?
Do your systems stay up and run the way they should?
Are you paying for things you don't need while missing things you do?
What AI tools are people using, and what are they putting into them?
One for each regulated framework
If you answer to a regulated framework, such as SEC Regulation S-P, HIPAA or CMMC, you get a Compliance Posture Report for it every quarter. Each framework gets its own report. Two frameworks are never combined.
Sample · Compliance Posture Report
ACME Corp · Quarter 3 · Reg S-P
Sample report for a fictional business. Example figures.
What the rule asks for, the control that meets it, and the evidence.
Tested, current or enforced, with the date it was last checked.
What isn't in place yet, and which to close first.
We provide the evidence. The person in charge of compliance on your team decides whether you're compliant.
When it arrives
Your Baseline Posture Score comes before handoff, so you know exactly where you started. After that, your Posture Reports arrive every quarter, without you asking, and your Technology Adviser reviews them with you: what we finished, what's planned next, how your score moved and what we recommend. Proof in hand is never more than three months old.
A fair question for any provider
Even if you've had an IT report before, ask two questions about it. Did it arrive without you asking? And would it answer the next person who asks you for proof?
See one first
Get a sample of each report by email: a Technology Posture Report and a Compliance Posture Report.
One question to ask yourself
In 30 minutes, we talk through your setup and you leave knowing which plan fits.
Book a call
