01Sample reviewSheet 01 of 07

Illustrative

Harbour Clinic is an invented clinic. This sample was made by our review tool from example data, so the people, accounts and dates in it are not real.

A sample Security Review.

This is what you get from a Security Review: the summary a manager can read in a minute, every finding ranked by risk, how to fix each one, and a fix plan. You get it as a report and in your own client portal, where the fixes are tracked.

Book a review call About the review

FL-SR-SAMPLE-02 · Rev ASample

Prepared forHarbour Clinic (invented)

Prepared byCallum Fraser, Fraser Lomond

Read on27 October 2026

Scope11 accounts, 3 phones and tablets, 1 domain, 36 controls

02SummarySheet 02 of 07

Summary

Three critical gaps leave accounts or data open today, with nine high-severity findings behind them. The most urgent: 2-step verification is not enforced: people can sign in with a password alone.

Two risks are accepted on purpose and listed with their reasons; they don’t count towards this.

3Critical

9High

12Medium

2Low

2Accepted

4In place

The fixes that matter most

2-step sign-in isn’t enforced for everyoneCriticalSR-01
2-step verification is not enforced: people can sign in with a password alone.
Some active accounts have no 2-step sign-inCriticalSR-02
Five of 11 active accounts have no 2-step verification, including an admin.
Super admins are too many, too few or unprotectedCriticalSR-03
One super admin has no 2-step verification.

By area

Area	Most serious	Open	What we found
Accounts and sign-in	Critical	10	2-step verification is not enforced: people can sign in with a password alone. Nine more open findings here.
Email	High	7	Email authentication is missing or broken on harbourclinic.example, so email can be faked in your name. Six more open findings here.
Files	Medium	4	Files can be shared with anyone outside, including people without a Google account. Three more open findings here.
Third-party apps	High	2	People can give any third-party app access to their mail, files and calendar. One more open finding here.
Devices	High	3	One device isn’t encrypted. Two more open findings here.

03Findings registerSheet 03 of 07

Findings register

Every open finding, most serious first, with the effort to fix it. 26 in this sample.

ID	Severity	Finding	Effort
SR-01	Critical	2-step sign-in isn’t enforced for everyone	An hour, plus a week’s notice to staff
SR-02	Critical	Some active accounts have no 2-step sign-in	An hour per person
SR-03	Critical	Super admins are too many, too few or unprotected	An hour
SR-04	High	Old or unused accounts still have admin rights	Minutes
SR-05	High	Risky sign-ins to explain	An hour to review
SR-06	High	Your domains can be spoofed in email	An hour, plus DNS changes
SR-07	High	Gmail’s spoofing protections are partly off	Minutes
SR-08	High	Email can be forwarded automatically outside	Minutes, plus checking existing forwards

Show the other 18 findings

ID	Severity	Finding	Effort
SR-09	High	Any app can be given access to company data	An hour, after reviewing apps in use
SR-10	High	Unencrypted phones or tablets	Varies by device
SR-11	High	Compromised or silent phones	Minutes per device
SR-12	High	Alert recipients to confirm	Minutes
SR-13	Medium	Unused accounts are still active	An hour
SR-14	Medium	Password rules fall short	Minutes
SR-15	Medium	Super admins can reset their own password by email or text	Minutes
SR-16	Medium	Some attachment and link protections are off	Minutes
SR-17	Medium	POP or IMAP is open	Minutes
SR-18	Medium	Some sending servers skip the spam filter	Minutes
SR-19	Medium	Outside sharing is open	An hour, with the team leads
SR-20	Medium	Files can be published or start shared	Minutes
SR-21	Medium	Shared drives can let outsiders in	Minutes
SR-22	Medium	Files shared with personal accounts	An hour to review
SR-23	Medium	Any Marketplace app can be installed	Minutes
SR-24	Medium	Device rules don’t block risky phones	Minutes
SR-25	Low	Sessions last too long	Minutes
SR-26	Low	Suspicious email isn’t held back for scanning	Minutes

04Findings in detailSheet 04 of 07

Findings in detail

Each finding is written for whoever fixes it: what we saw, why it matters, the steps in the Admin console, and the evidence. Two of the 26, as examples.

SR-01CriticalFL-01

2-step sign-in isn’t enforced for everyone

What we saw. 2-step verification is not enforced: people can sign in with a password alone.

Why it matters. A password alone is the most common way into a Google account. Cyber Essentials v3.3 requires MFA on every cloud service.

How to fix it. Security › Authentication › 2-step verification.

Select the top organisational unit.
Tick “Allow users to turn on 2-step verification”.
Under Enforcement choose “On”, and set “New user enrollment period” to 1 week.
Choose “Any except verification codes via text, phone call” if everyone has a phone app or key.
Save. Check any team listed in the evidence: if it shows “Overridden”, choose “Inherit”.

Evidence.

Whole organisation: not enforced

Effort. An hour, plus a week’s notice to staff.

SR-13MediumFL-07

Unused accounts are still active

What we saw. Three active accounts haven’t been used for 90 days or more.

Why it matters. An account nobody uses is one nobody notices being taken over. Cyber Essentials asks for accounts to be removed or disabled when no longer needed.

How to fix it. Directory › Users.

Check each account in the evidence with its manager.
For leavers: transfer their Drive files and email (Data transfer), then suspend or delete the account.
For shared mailboxes: use a Google group or a delegated mailbox instead of a shared password.

Evidence.

11 active accounts in total
Billing (billing@harbourclinic.example) · last sign-in never · created 22 Sept 2025
IT Support (it.support@harbourclinic.example) · last sign-in 10 Apr 2026 · created 18 Aug 2024
James Locum (locum.james@harbourclinic.example) · last sign-in 9 Jun 2026 · created 31 Dec 2025

Effort. An hour.

05Fix planSheet 05 of 07

Fix plan

The findings grouped into phases. Each phase is priced in your report, before you commit to anything.

Phase	What	Findings	When
Phase 1	Close the critical and high-severity gaps	SR-01 to SR-12	Within two weeks
Phase 2	Tighten the remaining settings	SR-13 to SR-24	Within six weeks
Phase 3	Smaller improvements	SR-25, SR-26	At the next quarterly review

Accepted risks

Findings the clinic has chosen to keep for now, with the reason, who decided and when it’s looked at again. They don’t count towards the summary.

FL-04Mediumif left open

Admins can use phishable 2-step methods. The two super admins sign in with passkeys on their own phones. Hardware keys are planned when the clinic moves to the new building.

Accepted by Jane Doe, Practice Manager. Looked at again by 13 January 2027.

FL-24Mediumif left open

Company files can be synced to any laptop. Two consultants work offline between sites. Their laptops are encrypted and managed; the rest of the team works in shared drives.

Accepted by Jane Doe, Practice Manager. Looked at again by 8 November 2026.

06In the portalSheet 06 of 07

After the report: the fix plan, tracked

In the client portal, every open finding becomes an action with an owner, a due date and a status. When the next review finds a fix in place, the action is ticked off; if a fix marked done is found again, it reopens.

Action	Severity	Who	Status	Due
Old or unused accounts still have admin rights Waiting for the partners to confirm which old accounts can go.	High	Harbour Clinic	To do	25 October 2026
Some active accounts have no 2-step sign-in Booked for Thursday morning, before clinic opens.	Critical	Fraser Lomond	In progress	10 November 2026
Super admins are too many, too few or unprotected Needs the partners to choose which two people stay super admins.	Critical	Harbour Clinic	To do	10 November 2026
Risky sign-ins to explain	High	Fraser Lomond	To do	10 November 2026
2-step sign-in isn’t enforced for everyone Done on a call with Jane, the practice manager.	Critical	Fraser Lomond	Done The next review confirms it	27 October 2026

5 of the sample’s 26 actions.

The client home in the Fraser Lomond portal for Harbour Clinic, an invented clinic. It says where the clinic stands in one sentence, the next action and the next review date; four tiles for Workspace, Email, Devices and Backups, each with its status in words; then the fix plan, with each action’s severity, who’s doing it and its status. — Fig. 1 · Client homeIllustrative · Harbour Clinic is an invented clinic

Illustrative

End of the sample. Harbour Clinic and everything about it is invented. Your review is made from your own Google Workspace, read with access you give us for the review.

07ContactSheet 07 of 07

Book a Security Review.

Tell me a little about your business and what’s on your mind. I reply within one working day.

Prefer to talk?Book a 20-minute call