CyberPosturaBack
Sample

Sample board report

Northbay Joinery is a made-up business. This is sample data, not a genuine company rating, and its code cannot be checked.

CyberPosturaCyber security rating report October 2026 Page 1 of 2

Northbay Joinery Ltd

Cyber security position at 25 October 2026 · prepared for the directors · Sample data

2 Critical4 High2 Medium2 Low
2 Critical4 High2 Medium2 Low

Rating

Medium riskMediumUp 6 since September

Basis of this rating

12checked by our scan or connected tool18told to us, not yet verified—validated level, by an expert

Level from the company’s answers Level 1 · Level checked by an expert not yet

Summary for the board

Northbay Joinery is at medium risk and improving. Two gaps could stop the business for days: staff remote access has a flaw attackers are using now, and one person can add a new payee and pay alone. Both are planned for this week. Finishing this week’s three fixes takes the score to 69.

Key strengths

Main apps use a second sign-in stepMicrosoft 365, Xero and Mailchimp · checked
Backups run every nightCloud backup · told us
Suppliers use named accountsIT provider and web host · told us

Key risks

Remote access flaw being exploitedNetwork · seen by our scan
One person can add a payee and payBusiness processes · told us
Backups never test-restoredData and backups · told us

What would raise the rating

Finish this week’s three fixes (+11, to 69)

Test-restore one backup (+3, to 72)

What would lower it

Remote-access update not installed by 1 Nov

Leavers’ accounts left open after staff go

Score, last six months

41May44Jun47Jul49Aug52Sep58Oct
Verify this report

Verify this report

Sample report

Sample data. Not a genuine company rating.

Prepared by CyberPostura for the directors of Northbay Joinery Ltd. Sample data. Sources: recorded assessment answers and available scan findings. Answers given by the company are not checked by CyberPostura.CONFIDENTIAL
CyberPosturaCyber security rating report October 2026 Page 2 of 2

Your board’s five duties

Based on the UK Cyber Governance Code of Practice (DSIT and NCSC, April 2025). The Code is written for larger firms; we use it as good practice for yours.

Board dutyWhere you standStatusNext step
1Risk managementRisks are known from this report; there is no risk register yet.Partly in placeStart the risk register (roadmap, next month)
2StrategyNo written cyber plan. The CyberPostura roadmap can become it.Not in placeAdopt the roadmap as the plan
3Culture and peoplePassword manager in use. Phishing training not answered.Partly in placeApprove staff training (decision 3)
4Incident planningNo incident plan. Nobody knows who to call.Not in placeOne-page plan, template ready
5OversightIT provider runs security; no named director owns it.Partly in placeName a director (decision 1)

Decisions needed from the board

Tick one box for each and keep this page with your board minutes.

1

Name a director as owner for cyber security

Today nobody on the board owns it. One named owner signs off fixes and talks to the IT provider.

Cost and time: None · We recommend: Approve
ApprovedNot approvedDiscuss again
2

Approve encryption for the 3 remaining laptops

A lost unencrypted laptop with customer data can be a reportable breach.

Cost and time: About 2 hours of IT provider time · We recommend: Approve
ApprovedNot approvedDiscuss again
3

Approve phishing training for all 25 staff

Most break-ins start with a convincing email. Training is the cheapest defence.

Cost and time: Quote to follow · We recommend: Approve
ApprovedNot approvedDiscuss again
Reviewed by (director)
Signature
Date
Verify this report

Verify this report

Sample report

Sample data. Not a genuine company rating.

Board duties follow the UK Cyber Governance Code of Practice (DSIT and NCSC, April 2025). Costs are estimates for planning, not quotes. CyberPostura gives guidance, not legal advice.CONFIDENTIAL