Remediation
Track and resolve findings. Mark remediation or request CyberSecurer validation.
No AI acceptable-use policy
CriticalAI Security · Owner: Security Lead · Due: 2026-10-15
Description
No documented policy governing AI usage.
Business impact
Uncontrolled AI usage may expose sensitive data.
Recommended remediation
Establish an AI acceptable-use policy and inventory AI usage.
MFA not enforced for admins
HighIdentity · Owner: IT Admin · Due: 2026-10-22
Description
Administrator accounts lack enforced MFA.
Business impact
Privileged accounts are exposed to credential attacks.
Recommended remediation
Enforce MFA for all administrator accounts.
DMARC not configured
HighEmail · Owner: Email Admin · Due: 2026-10-20
Description
No DMARC policy on primary domain.
Business impact
Domain spoofing and phishing risk.
Recommended remediation
Configure DMARC with enforcement policy.
No offline/immutable backups
CriticalResilience · Owner: Infrastructure · Due: 2026-10-30
Description
Backups are not offline or immutable.
Business impact
Ransomware recovery may fail.
Recommended remediation
Implement offline/immutable backups and test recovery.
