Sample report. Every figure, finding and client name below is fictional and shown to illustrate the structure and depth of a SkyRocket engagement deliverable.
What a cybersecurity maturity assessment tells you.
A complete sample deliverable: 20 controls scored against NIST CSF 2.0, a risk register, and a sequenced remediation plan. This is the report, not a brochure about it.
Section 01
Executive Summary
Overall Security Posture
This organization has credible foundational controls: multi-factor authentication, encryption, endpoint protection, an active SIEM and monthly-tested backups are all in place, and the incident response team is experienced. The constraint is governance and automation, not tooling. Of five core policy areas, none is documented and operating completely, and the controls that exist depend on manual effort that does not scale. The program scores 2.43 of 5.00 (Tier 2, Risk Informed).
Five Findings That Matter Most
| # | Finding | Why it matters | Severity |
|---|---|---|---|
| 1 | No documented policy in any core area | Access control is informal, IR is ad hoc, key management undefined. Controls without policy cannot be enforced consistently, audited, or defended to an examiner. | Critical |
| 2 | Vulnerabilities scanned but not tracked | Scans run, but findings are not centrally tracked and there are no severity-based remediation SLAs, so exposures persist with no owner and no deadline. | Critical |
| 3 | Mobile and BYOD endpoints unmanaged | Servers and workstations are tracked; mobile devices are not tracked at all. An inventory with a known blind spot cannot support any downstream control. | High |
| 4 | No privileged access policy | MFA and centralized IAM are in place, but privilege is not governed and offboarding is manual. That's how orphaned and over-privileged accounts accumulate. | High |
| 5 | No incident response playbooks | An experienced team handles incidents well informally. Without playbooks, performance depends on who is available and escalation is inconsistent under pressure. | Medium |
The single highest-return action. Three of six functions rate Red, and all three are constrained by Process rather than Technology. The first phase of the roadmap therefore targets documentation and automation of controls that already exist: the lowest-cost, highest-yield work available.
Section 02
NIST CSF 2.0 Maturity Assessment
The distribution matters more than the average. Recover (3.40) and Detect (2.95) approach the 3.5 target, while Govern (1.45) and Identify (1.90) sit in the lowest band: the characteristic shape of an organization that invested in operational tooling while governance did not keep pace.
| Function | Strengths | Key gaps | Score | Rating |
|---|---|---|---|---|
| Govern (GV) derived | Security decisions reach senior leadership. | No documented policy set; no review cadence or accountable owner. | 1.45 | Red |
| Identify (ID) | Asset inventory in place for servers and workstations. | No classification or lifecycle tracking; mobile and BYOD untracked. | 1.90 | Red |
| Protect (PR) | MFA enforced and encryption implemented. | No privileged access policy; manual de-provisioning; no key management policy. | 2.35 | Red |
| Detect (DE) | SIEM and endpoint protection active; skilled analysts. | Manual log reviews; partial network coverage; no automated correlation. | 2.95 | Yellow |
| Respond (RS) | Experienced team resolves incidents effectively. | No playbooks, no communication plan, no post-incident review. | 2.50 | Yellow |
| Recover (RC) | Backups tested monthly with verified restores. | No recovery prioritization; recovery plan undocumented. | 3.40 | Yellow |
Reading the shape, not the score. Protect rates Red overall despite Green technology, because MFA and encryption are deployed without the policy that governs them. That is this report's central pattern. Closing the gap is largely documentation and automation against controls already owned, which is why Phase 1 requires no new tooling spend.
How these scores are calculated
Each control is rated in three dimensions. Ordinal ratings convert to a 0–5 scale (Green 4.0, Yellow 2.5, Red 1.0) and combine as (People × 0.30) + (Process × 0.40) + (Technology × 0.30). Process carries the heaviest weight because a control that is not documented cannot be enforced, audited, or transferred when staff change.
| Tier | Name | Range |
|---|---|---|
| Tier 1 | Partial | 0.00 – 1.49 |
| Tier 2 | Risk Informed current | 1.50 – 2.49 |
| Tier 3 | Repeatable | 2.50 – 3.49 |
| Tier 4 | Adaptive | 3.50 – 5.00 |
GOVERN is scored from policy and process evidence gathered across the engagement rather than a dedicated control set, and is labelled derived wherever it appears. NIST CSF 2.0 added GOVERN as a sixth function; assessments built on the five-function model predate that change.
Section 03
People / Process / Technology
This is the most operationally useful view in the report: it identifies which kind of intervention each function needs: training and ownership, documentation and workflow, or configuration and tooling.
Swipe the table to see all dimensions
| CSF Function | People | Process | Technology | Overall | Score |
|---|---|---|---|---|---|
| Govern (GV) derived | Yellow | Red | Red | Red | 1.45 |
| Identify (ID) | Yellow | Red | Yellow | Red | 1.90 |
| Protect (PR) | Yellow | Red | Green | Red | 2.35 |
| Detect (DE) | Green | Yellow | Yellow | Yellow | 2.95 |
| Respond (RS) | Yellow | Yellow | Yellow | Yellow | 2.50 |
| Recover (RC) | Green | Yellow | Green | Yellow | 3.40 |
| Dimension | Interpretation | Implication |
|---|---|---|
| People (3.0) | The strongest dimension. Staff are capable and, in Detect and Recover, demonstrably effective. Capability is not the constraint. | Do not lead with training spend. Lead with removing manual toil from capable people. |
| Process (1.75) | The weakest dimension and the binding constraint. Every Red overall rating in this report traces to Process. | Phases 1 and 2 are almost entirely process work: policy, SLAs and automation. |
| Technology (2.75) | Adequate to good. The platforms needed to close most gaps are already licensed and deployed: under-configured, not absent. | Configure and integrate before purchasing. MDM is the one genuine acquisition. |
Process is the lowest-rated dimension in all six functions, uniquely lowest in three and tied-lowest in the other three, and it is never the highest. Overall ratings are worst-case weighted rather than averaged, because an undocumented control fails the moment the person who knows it is unavailable.
Section 04
Findings
Eight findings, each mapped to its CSF 2.0 subcategory. Severity reflects business impact in this environment rather than generic scoring. The same technical condition warrants different severities in different organizations.
| ID | Domain | Observation | Business impact | Severity |
|---|---|---|---|---|
| F-01 | Asset Management ID.AM-01 | Workstations and servers tracked; network devices reviewed annually; mobile and BYOD not tracked at all. | Unmonitored assets increase breach exposure and make every downstream control incomplete by definition. | High |
| F-02 | Vulnerability Management ID.RA-01 | Endpoint scans performed but results not centrally tracked, prioritized, or bound to remediation timelines. | Vulnerabilities remain unresolved with no owner and no deadline; exposure duration is unmeasured. | Critical |
| F-03 | Access Management PR.AA-05 | MFA enforced and onboarding defined. No privileged access policy; reviews annual and limited in scope. | Over-privileged and orphaned accounts accumulate undetected between manual reviews. | High |
| F-04 | Data Protection PR.DS-01 | Encryption enabled at rest and in transit. No key management policy covering rotation, custody or audit. | Inconsistent control of sensitive data and no defensible answer on key custody during an audit. | High |
| F-05 | Detection Coverage DE.CM-01 | SIEM and endpoint protection active. Partial log ingestion; manual review; no automated correlation. | Detection depends on analyst availability; ingestion gaps create blind spots invisible as gaps. | Medium |
| F-06 | Incident Response RS.MA-01 | Backups verified and the team is experienced. Handling is informal with no playbooks or communication plan. | Slower recovery and inconsistent escalation; performance varies with who is on call. | Medium |
| F-07 | Recovery Planning RC.RP-01 | Backups tested monthly. Recovery order not prioritized; recovery plan undocumented. | Restoration sequence decided under pressure, extending outage duration for critical services. | Medium |
| F-08 | Configuration Management PR.PS-01 | Baselines exist for part of the estate. No change tracking or approval process. | Configuration drift accumulates silently and undermines controls correct at deployment. | Medium |
A consistent pattern runs through all eight: the technology required is present, and the gap is the policy, integration or automation around it. F-01 is the only finding requiring net-new tooling.
Section 05
Risk Register
Six risks are carried. Likelihood and impact are scored 1–5; the product sets the band. Four derive directly from assessed findings; two are marked derived, inferred from evidence gathered for other controls.
R-01 is the only Critical. Unpatched systems score 16 because both likelihood and impact are high: scanning already proves the exposures exist, and no SLA bounds how long they persist. It is first in the roadmap for that reason, not because patching is inherently the most important control.
| ID | Risk | Lkhd | Impact | Score | Band | Basis |
|---|---|---|---|---|---|---|
| R-01 | Unpatched Systems | 4 | 4 | 16 | Critical | No centralized vulnerability tracking or severity-based remediation SLAs. |
| R-02 | Orphaned Accounts | 3 | 4 | 12 | High | No privileged access policy; de-provisioning is manual. |
| R-03 | Unmanaged Mobile Endpoints derived | 4 | 3 | 12 | High | DERIVED from ID.AM-01: no mobile/BYOD tracking and no MDM enforcement. |
| R-04 | Data Leakage | 3 | 3 | 9 | Medium | Encryption enabled but no key management policy. |
| R-05 | Delayed Incident Containment | 3 | 3 | 9 | Medium | No IR playbooks or communication plan; handling is informal. |
| R-06 | Undocumented Recovery Order derived | 2 | 4 | 8 | Medium | DERIVED from Recover gaps: backups tested, no recovery prioritization. |
Bands: Low 1–4 · Medium 5–9 · High 10–15 · Critical 16–25.
Section 06
Policy & Process Gaps
Governance is the binding constraint. Of five core policy areas, none is documented and operating completely. This is the evidence base for the derived GOVERN score of 1.45.
| Policy area | Current status | Gap identified | Recommendation |
|---|---|---|---|
| Access Control | Informal process | No documented policy or automation. | Develop policy defining least privilege and entitlement reviews. |
| Vulnerability Management | Scans exist | No severity-based remediation timelines. | Establish policy defining scan frequency and response SLAs. |
| Incident Response | Ad hoc | No playbooks or testing. | Create formal IR plan and conduct annual exercises. |
| Key Management | Not defined | No rotation or audit policy. | Define key lifecycle management policy. |
| Configuration Management | Partial | No change tracking or approval process. | Implement quarterly configuration reviews. |
Why policy precedes tooling. Each of these five areas already has functioning technology behind it. A policy is what converts a working configuration into an enforceable, auditable, transferable control. It's also what an examiner, an underwriter or an acquirer asks to see. Four of the five recommendations require no capital expenditure.
Section 07
Remediation
Eight priority actions, each mapped to the function it advances and its roadmap phase. Phase assignment follows sequencing logic rather than severity alone. An action that unblocks others may precede a higher-severity item that stands alone.
Quick Wins: No Procurement Required
| Action | Effect | Effort |
|---|---|---|
| Set remediation SLAs by severity | Converts existing scan output into a tracked, time-bound queue. Addresses the only Critical risk in the register. | 1–2 days, policy only |
| Expand access reviews to all systems | Removes the scope gap that lets orphaned accounts persist between annual cycles. | 3–5 days, no tooling |
| Document the recovery order | Backups are already tested; recording the sequence removes the decision from the outage window. | 2–3 days, workshop |
| Enable SIEM correlation for identity events | Surfaces privilege escalation using a platform already licensed and ingesting IAM logs. | 1 day, configuration |
These four address one Critical and one High risk between them and require no capital expenditure. They're the recommended first two weeks.
Full Remediation Set
| Function | Priority action | Mapped service | Phase | Priority |
|---|---|---|---|---|
| Identify | Deploy MDM and enforce mobile/BYOD enrollment; automate asset discovery; integrate asset data with SIEM and procurement. | NOC as a Service | Phase 1 | High |
| Identify | Establish centralized vulnerability tracking with severity-based remediation SLAs. | VMPaaS | Phase 1 | Critical |
| Protect | Author and approve a Privileged Access Policy defining least privilege and review cadence. | vCISO Service | Phase 1 | High |
| Protect | Automate IAM de-provisioning on the HR offboarding trigger; expand access reviews to all systems. | IAM / Endpoint Protection | Phase 2 | High |
| Protect | Define a key lifecycle management policy covering rotation, custody and audit. | vCISO / Data Security | Phase 3 | Medium |
| Detect | Expand SIEM log ingestion to full network coverage; automate alerting and correlation. | SOC as a Service / SIEMaaS | Phase 2 | Medium |
| Respond | Develop IR playbooks for the top five scenarios; run a tabletop exercise. | Incident Response / vCISO | Phase 3 | Medium |
| Recover | Document the recovery plan with a prioritized restoration order; institute lessons-learned reviews. | Managed Backup Service | Phase 3 | Medium |
Section 08
Roadmap
Three phases over twelve months. Sequence is driven by four questions applied to every finding: what does it actually expose, who already has a path to it, what does closing it cost in hours rather than dollars, and what does closing it unblock downstream.
| Phase | Timeframe | Focus | Expected outcome |
|---|---|---|---|
| Phase 1: Stabilize | 0–30 days | Deploy MDM and close the mobile inventory gap. Stand up centralized vulnerability tracking with severity-based SLAs. Formalize and approve the Access Control Policy. | Visibility and control baseline achieved; the Critical risk is bounded by a deadline. |
| Phase 2: Strengthen | 30–90 days | Automate patch deployment against the new SLAs. Automate IAM de-provisioning on the HR trigger. Expand SIEM ingestion to full coverage with automated correlation. | Improved detection and faster remediation; manual effort removed from capable staff. |
| Phase 3: Optimize | 90+ days | Develop and exercise IR playbooks. Define key lifecycle management policy. Establish quarterly governance and configuration review cadence. | Sustainable, measurable maturity with a governance cadence that holds. |
Expected trajectory. Executing all three phases moves the program from 2.43 (Risk Informed) toward the 3.5 (Repeatable) target, with the largest single gain in GOVERN. Organizations that execute a sequenced plan of this shape typically advance one implementation tier within twelve months, an expectation based on comparable engagements, not a guarantee.
Section 09
Service Alignment
Each gap maps to a specific service. These are proposed against findings in this report, not selected from a catalog. Where a gap can be closed internally at no cost, that's stated in the Remediation section instead.
Progress is evidenced independently as items close, through penetration testing and vulnerability management rather than by self-assessment.
Appendix
Control-Level Detail
Two of the 20 assessed controls, reproduced in full to show the depth delivered for every control in the engagement.
Objective. Maintain an accurate, current inventory of all hardware assets including servers, workstations, network devices and mobile endpoints.
Current state
- Servers and workstations tracked through an RMM platform.
- Network devices reviewed annually.
- No mobile or BYOD tracking in place.
Gaps identified
- Missing mobile device policy and MDM enforcement.
- No integration between asset inventory and procurement.
- Annual network review cadence too infrequent to be reliable.
Recommendations
- Deploy an MDM solution and enforce enrollment.
- Conduct quarterly network discovery scans.
- Integrate asset data with the SIEM for correlation.
Objective. Ensure user and system access permissions are defined, reviewed and enforced according to least privilege.
Current state
- MFA and centralized IAM are in place.
- Annual access reviews for selected systems.
- No formal policy and no automated alerting.
Gaps identified
- No Privileged Access Policy in force.
- Manual reviews limit scalability and coverage.
- No alerts for privilege escalation or anomalous entitlement change.
Recommendations
- Author and approve a formal Access Control Policy.
- Expand review scope to all systems, quarterly.
- Integrate IAM with the SIEM for automated alerting.
Overall is worst-case weighted. PR.AA-05 rates Red because Process is Red: capable people and adequate technology cannot compensate for an absent policy when the person holding the knowledge is unavailable.
Next step
What your report would contain
Everything above, built on your environment rather than a sample: all 20 controls assessed, your own risk register, and a flight plan sequenced for your constraints. Findings in two weeks.
20 control analyses
Every assessed control with People, Process and Technology ratings and specific recommendations.
Your risk register
Likelihood and impact scored for your environment, with the reasoning recorded.
A sequenced flight plan
30 / 90 / 90+ day phases, with quick wins that need no procurement separated out.
A live walkthrough
A named consultant presents every finding to your leadership, and stays engaged while you execute.
Talk through your own results
Fifteen minutes is enough for us to tell you whether an assessment would help, including if the answer is not yet.
Questions
Frequently Asked Questions
What is the SkyRocket Accelerated Gap Analysis?
It is a two-week cybersecurity maturity assessment measuring an organization against 20 foundational NIST CSF 2.0 controls across all six functions. Each control is rated in three dimensions (People, Process and Technology), and the output is a scored baseline plus a sequenced remediation plan with the reasoning recorded, not a ranked list of findings.
How is this different from a free online scan or self-assessment?
A scan returns output; this returns a plan. The assessment is expert-led rather than questionnaire-based, benchmarked to the framework your auditors already use, and delivered with a named consultant who explains every finding and stays engaged while you execute. A two-minute self-assessment is a directional starting point, not the assessment itself.
Do I have to buy anything after the assessment?
No. The plan is yours regardless of who executes it. Some items your own team will close internally at no cost. Others may call for solutions or managed coverage, and those are proposed against specific findings in your plan rather than from a catalog. In organizations of this size the most common finding is that what you already own isn't fully configured, not that you need to buy something.
Why does this assessment score six functions when NIST CSF has five?
NIST CSF 2.0 added GOVERN as a sixth function. Governance moved from an implicit concern to a first-class one. Assessments built on the five-function model predate that change. GOVERN is scored here from policy and process evidence gathered across the engagement and is labelled as derived wherever it appears.
What do the maturity tiers mean?
They follow the NIST CSF implementation tiers: Tier 1 Partial, Tier 2 Risk Informed, Tier 3 Repeatable, Tier 4 Adaptive. Tiers rather than raw scores are used in executive communication because the tier language belongs to the framework and is already understood by auditors, examiners and underwriters.
How long does an assessment take, and what does it require from my team?
Findings in two weeks. The engagement requires document review, configuration inspection, and interviews with the owners of each control area: typically a few hours per domain owner rather than a dedicated project team.
Who is this built for?
Organizations of 5,000 employees or fewer in South Florida and the Caribbean, particularly those with a lean security or IT function and an improvement backlog that has never been sequenced. Roughly half of organizations run security with fewer than six people; that is the constraint this program is designed around.