Governance evidence,
not technical noise.

Report extract · Executive summary

Overall Governance Position: Amber

Configuration score is PASS divided by PASS plus FAIL plus WARN. Benchmark score is PASS divided by all 96 controls. Licence-gated and not-assessed controls are excluded from the scores and are not failures.

The organisation's Microsoft 365 environment is partially governed. Controls exist in some domains but are inconsistently applied and not evidenced at board level. Four of the fourteen assessed domains require immediate board attention. Three meet the expected governance baseline. Seven show partial governance with specific gaps identified. The two Azure domains were not in scope for this organisation.

This assessment was conducted using read-only access. No configuration was changed. The findings reflect the state of the environment at the time of assessment and are framed for board oversight, not operational remediation.

The executive summary gives the board an immediate governance position without requiring technical interpretation. The RAG rating is supported by the domain detail that follows.

Report extract · Domain overview

Sixteen domains. One governance position.

Each domain is rated Red, Amber or Green from its findings. A domain may carry a Red position at a high configuration score where a single finding creates material exposure. The board can see at a glance where governance is strong, where gaps exist and where immediate attention is needed. Out-of-scope domains are stated, never silently omitted. Trend indicators are included in standing assurance engagements to show movement over time.

Report extract · Domain detail

Domain 01: Identity and Access Management Amber

Authentication controls are partially configured. Conditional access policies exist but do not consistently enforce multi-factor authentication across all access scenarios. Privileged accounts do not operate under a dedicated access tier. Third-party application permissions have been granted through OAuth consent but have not been formally reviewed or approved through a governance process.

The organisation cannot currently evidence to the board that access to its Microsoft 365 environment is governed to a standard consistent with its risk appetite or regulatory obligations.

Board challenge questions:

• Has management confirmed that multi-factor authentication is enforced for all users, including privileged accounts and service accounts?
• When was the last formal review of which third-party applications have been granted access to organisational data, and who approved that access?
• Can management evidence that access controls are tested periodically, not just configured once?

The governance narrative tells the board what the position is. The board challenge questions tell the board what to ask management. InquilionGRC provides the evidence. The board provides the accountability.

Report extract · Prioritised actions

What the board should ask for next.

Priority 1 (Immediate: within five working days)

The board should seek assurance from management that authentication controls are applied consistently across all access scenarios. A defined timeline for remediation should be requested, with evidence of completion reported back to the board or audit committee.

Priority 2 (Within 30 days)

Management should conduct a formal review of all third-party applications with access to organisational data and present the findings to the board. Any application consent that cannot be attributed to a business requirement should be revoked.

Priority 3 (Within 60 days)

The board should request that management implement a rolling review cycle for application permissions, external sharing configurations and guest access, evidenced and reported as part of standing governance oversight.

Actions are framed for the board, not for IT. The Compliance Report provides the operational detail required to execute remediation. InquilionGRC does not tell management how to configure. It tells the board what to ask management to evidence. Independence from delivery is absolute.

Report extract · Regulatory alignment

Every finding mapped to the frameworks that matter.

The baseline frameworks above are cited in every assessment. Beyond them, findings are mapped from a maintained reference library of more than 160 primary sources across nearly forty regulators, statutes and frameworks: UK and EU data protection, financial services regulation, cyber baselines, corporate governance codes and the US and offshore regimes that apply where an organisation operates. Mapping is scoped to each organisation's sector and jurisdictions: a charity is not assessed against banking rules, and a fund administrator in Jersey sees its own regulator reflected. Regulatory mappings indicate areas of relevance and potential exposure. They do not constitute legal advice or a determination of compliance. InquilionGRC does not provide legal advice or certification. It provides the governance evidence that supports compliance conversations.

The library is maintained as regulation evolves. The engagement letter records the frameworks in scope for each client.

Risk report extract

Risk entry: Multi-factor authentication is not enforced for all users

Risk reference

RR-Q1-01 · Check D1-001

Risk and exposure

No active Conditional Access policy enforces multi-factor authentication for all users. Policies exist but none are scoped to all users with an MFA grant control in an enabled state. User accounts can be accessed with a password alone.

Control objective (treatment)

MFA enforced for all users via Conditional Access.

Rating

Critical

Owner and target

IT · 30 days

The control objective is the treatment to be achieved; the operational actions and the order of work are set out in the Compliance Report. Likelihood and impact scoring against the company risk matrix is for the risk owner to complete. Every open finding in the Board Governance Report has a corresponding entry. The risk function can act on the assurance immediately.

Compliance report extract

Section 1 · Information Technology

Ref and status

D1-001 · FAIL

Severity and timeframe

Critical · 30 days

Control objective

MFA enforced for all users via Conditional Access.

Finding

No active Conditional Access policy enforces MFA for all users. Policies exist but none are scoped to all users with an MFA grant control in an enabled state. Users can authenticate with a password alone.

Standards in scope

NIST CSF 2.0 PR.AA-01; GDPR Art.32; NIS2 Art.21(2)(i); Cyber Essentials

InquilionGRC identifies what. Management decides how. That boundary is maintained in every deliverable. Findings are grouped by the function that owns them: Information Technology, then Compliance and Risk, then Commercial and Leadership. The complete control-by-control record, including passing controls, is held in the Technical Schedule at the end of the report: the evidence base, reproduced exactly as assessed. Where an organisation works with an MSP, the Compliance Report is self-contained and can be shared directly to inform remediation.