---
title: "Cybersecurity Assessment Template"
methodology: "universal"
complexity: "advanced"
owner: "mirichard"
updated: "2026-09-19"
primary_principles: ["risk-optimization"]
secondary_principles: ["evidence-based-decisions", "stewardship"]
principle_rationale: "Bounds a security posture assessment around assets, threats and vulnerabilities so owners can prioritize evidence-backed protection measures."
---

# Cybersecurity Assessment Template

## When to Use

- When assessing an IT environment's security posture before prioritizing improvements.
- When threat, vulnerability, asset, and response evidence need a bounded assessment scope.

## When NOT to Use

- As certification of security or a replacement for authorized technical testing.
- Do not use a completed template or example configuration as proof of fitness for the actual environment. See [Template as substitute for judgment](../../../../../docs/principles/anti-patterns.md#template-judgment).

## Pairs Well With

- [Risk Assessment Template](../../../../../domains/measurement/industry-specializations/information-technology/cybersecurity/risk_assessment_template.md).
- [Incident Response Template](../../../../../domains/measurement/industry-specializations/information-technology/cybersecurity/incident_response_template.md).

Selection context: Measurement domain; universal methodology; advanced complexity. Match the situations above to project phase, risk, team size, and industry using the [decision-engine context model](../../../../../meta/architecture-research/800-801-context-assessment-model.md).

## Framework and response applicability

When using NIST CSF, map the assessment to the six CSF 2.0 functions, including Govern. Record decision authority, risk appetite, oversight, and supply-chain responsibilities as well as technical controls. The [NIST CSF 2.0 overview](https://www.nist.gov/news-events/news/2024/02/nist-releases-version-20-landmark-cybersecurity-framework) explains the governance addition. Example response times and notification periods must be replaced by the approved service, incident, and jurisdiction-specific requirements.


## Document Control

| Document Information |                                      |
|----------------------|--------------------------------------|
| Document Title       | Cybersecurity Assessment Template    |
| Document Version     | 1.0                                  |
| Last Updated         | YYYY-MM-DD                           |
| Document Owner       | [Security Assessment Lead]           |
| Document Status      | [Draft/Under Review/Approved]        |
| Confidentiality      | [Internal/Confidential/Restricted]   |
| Document ID          | CSA-[Organization ID]-[YYYY-MM]      |

### Revision History

| Version | Date       | Description of Changes | Author        | Approver       |
|---------|------------|------------------------|---------------|----------------|
| 1.0     | YYYY-MM-DD | Initial draft          | [Name/Title]  | [Name/Title]   |

### Document Approvals

| Name             | Role/Title                       | Signature        | Date       |
|------------------|----------------------------------|------------------|------------|
| [Approver Name]  | CISO/Head of Security            | ________________ | __________ |
| [Approver Name]  | IT Director                      | ________________ | __________ |
| [Approver Name]  | Risk/Compliance Officer          | ________________ | __________ |
| [Approver Name]  | [Other relevant stakeholders]    | ________________ | __________ |

---

## 1. Executive Summary

### 1.1 Assessment Overview

**Organization/System Name:** [Name of organization or system assessed]

**Assessment Period:** [Start date] to [End date]

**Assessment Type:** [Comprehensive/Targeted/Compliance-focused]

**Assessment Purpose:** 
[Brief description of why the assessment was conducted, including any compliance or business requirements driving the assessment]

### 1.2 Key Findings Summary

[High-level summary of key findings, grouped by criticality. Include a brief narrative of the organization's overall security posture]

#### Critical Findings
* [Brief description of critical finding 1]
* [Brief description of critical finding 2]

#### High-Risk Findings
* [Brief description of high-risk finding 1]
* [Brief description of high-risk finding 2]

#### Medium-Risk Findings
* [Brief description of medium-risk finding 1]
* [Brief description of medium-risk finding 2]

### 1.3 Security Posture Summary

[Provide a high-level overview of the organization's security posture, including areas of strength and significant weaknesses]

| Security Domain           | Maturity Level          | Risk Level        |
|---------------------------|-------------------------|-------------------|
| Network Security          | [Low/Medium/High]       | [Low/Medium/High] |
| Endpoint Security         | [Low/Medium/High]       | [Low/Medium/High] |
| Access Control            | [Low/Medium/High]       | [Low/Medium/High] |
| Data Security             | [Low/Medium/High]       | [Low/Medium/High] |
| Cloud Security            | [Low/Medium/High]       | [Low/Medium/High] |
| Application Security      | [Low/Medium/High]       | [Low/Medium/High] |
| Security Operations       | [Low/Medium/High]       | [Low/Medium/High] |
| Security Governance       | [Low/Medium/High]       | [Low/Medium/High] |

### 1.4 Recommendation Summary

[Summarize the highest priority recommendations, including immediate actions needed]

#### Immediate Actions
* [Immediate action 1]
* [Immediate action 2]

#### Short-term Actions (0-3 Months)
* [Short-term recommendation 1]
* [Short-term recommendation 2]

#### Medium-term Actions (3-6 Months)
* [Medium-term recommendation 1]
* [Medium-term recommendation 2]

#### Long-term Actions (6+ Months)
* [Long-term recommendation 1]
* [Long-term recommendation 2]

---

## 2. Assessment Scope & Methodology

### 2.1 Scope Definition

[Define the scope of the assessment, detailing what was included and excluded]

#### In-scope Items
* [List of in-scope systems, applications, networks, facilities, processes, etc.]

#### Out-of-scope Items
* [List of explicitly out-of-scope items]

#### Assessment Boundaries
* [Description of logical and physical boundaries of the assessment]

### 2.2 Assessment Methodology

[Describe the methodology and framework(s) used for the assessment]

#### Assessment Framework(s)
* [Framework 1, e.g., NIST CSF, ISO 27001, CIS Controls]
* [Framework 2]

#### Assessment Approach
[Describe the overall approach to the assessment, including:
- Phases of the assessment
- Types of testing performed
- Tools and techniques used
- Evidence collection methods]

#### Assessment Team

| Name | Role | Responsibilities |
|------|------|-----------------|
| [Name] | Assessment Lead | [Responsibilities] |
| [Name] | Technical Assessor | [Responsibilities] |
| [Name] | [Role] | [Responsibilities] |

### 2.3 Assessment Limitations

[Document any limitations or constraints encountered during the assessment that may impact the findings or conclusions]

---

## 3. Current Security Posture

### 3.1 Network Security

#### 3.1.1 Network Architecture
[Describe and evaluate the current network architecture, segmentation, and zones]

#### 3.1.2 Perimeter Security
[Evaluate perimeter security controls including firewalls, IDS/IPS, and DMZ configuration]

#### 3.1.3 Internal Network Security
[Evaluate internal network security controls, including segmentation, monitoring, and traffic control]

#### 3.1.4 Wireless Network Security
[Evaluate wireless network security, including encryption, authentication, and guest access]

#### 3.1.5 Remote Access
[Evaluate remote access solutions, including VPN, MFA, and monitoring]

#### 3.1.6 Network Monitoring and Response
[Evaluate network monitoring capabilities, including logging, alerting, and incident response]

### 3.2 Endpoint Security

#### 3.2.1 Endpoint Protection
[Evaluate endpoint protection solutions, including antivirus, EDR, and application control]

#### 3.2.2 Patch Management
[Evaluate patch management processes for operating systems and applications]

#### 3.2.3 Configuration Management
[Evaluate system hardening and configuration management practices]

#### 3.2.4 Mobile Device Security
[Evaluate mobile device security, including MDM solutions and policies]

#### 3.2.5 Removable Media Controls
[Evaluate controls for removable media, including USB devices and external drives]

### 3.3 Access Control

#### 3.3.1 Identity Management
[Evaluate identity management practices, including provisioning, review, and deprovisioning]

#### 3.3.2 Authentication
[Evaluate authentication mechanisms, including password policies and MFA implementation]

#### 3.3.3 Authorization
[Evaluate authorization controls, including role-based access and least privilege principles]

#### 3.3.4 Privileged Access Management
[Evaluate privileged access management, including administrative account controls]

#### 3.3.5 Physical Access Controls
[Evaluate physical access controls to facilities, data centers, and sensitive areas]

### 3.4 Data Security

#### 3.4.1 Data Classification
[Evaluate data classification schemes and implementation]

#### 3.4.2 Data Protection
[Evaluate data protection mechanisms for data at rest, in transit, and in use]

#### 3.4.3 Data Loss Prevention
[Evaluate DLP solutions and their effectiveness]

#### 3.4.4 Encryption Management
[Evaluate encryption implementation and key management]

#### 3.4.5 Data Retention and Destruction
[Evaluate data retention policies and secure data destruction practices]

### 3.5 Cloud Security

#### 3.5.1 Cloud Service Provider Security
[Evaluate security of cloud service providers and shared responsibility model implementation]

#### 3.5.2 Cloud Configuration
[Evaluate cloud configuration, including identity management and access controls]

#### 3.5.3 Cloud Data Protection
[Evaluate data protection in cloud environments, including encryption and DLP]

#### 3.5.4 Cloud Monitoring and Logging
[Evaluate cloud monitoring, logging, and incident response capabilities]

### 3.6 Application Security

#### 3.6.1 Secure Development Practices
[Evaluate secure development lifecycle and practices]

#### 3.6.2 Application Vulnerabilities
[Evaluate common vulnerabilities in applications, including OWASP Top 10 issues]

#### 3.6.3 API Security
[Evaluate API security, including authentication, authorization, and input validation]

#### 3.6.4 Web Application Security
[Evaluate web application security, including authentication, session management, and input validation]

#### 3.6.5 Application Testing
[Evaluate application security testing practices, including SAST, DAST, and penetration testing]

---

## 4. Threat Assessment

### 4.1 External Threats

#### 4.1.1 Threat Actors
[Identify and evaluate potential external threat actors relevant to the organization]

| Threat Actor Type | Motivation | Capability | Targeting Likelihood |
|-------------------|------------|------------|----------------------|
| Nation-state | [Motivation] | [High/Medium/Low] | [High/Medium/Low] |
| Organized Crime | [Motivation] | [High/Medium/Low] | [High/Medium/Low] |
| Hacktivists | [Motivation] | [High/Medium/Low] | [High/Medium/Low] |
| [Other] | [Motivation] | [High/Medium/Low] | [High/Medium/Low] |

#### 4.1.2 External Attack Vectors
[Identify and evaluate potential external attack vectors]

| Attack Vector | Exposure Level | Existing Controls | Control Effectiveness |
|---------------|----------------|-------------------|-----------------------|
| Phishing | [High/Medium/Low] | [Controls] | [High/Medium/Low] |
| Web Application Attacks | [High/Medium/Low] | [Controls] | [High/Medium/Low] |
| Network-based Attacks | [High/Medium/Low] | [Controls] | [High/Medium/Low] |
| [Other] | [High/Medium/Low] | [Controls] | [High/Medium/Low] |

### 4.2 Internal Threats

#### 4.2.1 Insider Threat Profile
[Evaluate potential insider threats, including malicious and non-malicious insiders]

#### 4.2.2 Internal Attack Vectors
[Identify and evaluate potential internal attack vectors]

| Attack Vector | Exposure Level | Existing Controls | Control Effectiveness |
|---------------|----------------|-------------------|-----------------------|
| Privileged User Abuse | [High/Medium/Low] | [Controls] | [High/Medium/Low] |
| Data Exfiltration | [High/Medium/Low] | [Controls] | [High/Medium/Low] |
| Social Engineering | [High/Medium/Low] | [Controls] | [High/Medium/Low] |
| [Other] | [High/Medium/Low] | [Controls] | [High/Medium/Low] |

### 4.3 Industry-Specific Threats

#### 4.3.1 Industry Threat Landscape
[Describe threat landscape specific to the organization's industry]

#### 4.3.2 Recent Industry Attacks
[Document recent attacks or breaches in the industry and their relevance]

#### 4.3.3 Industry-Specific Attack Vectors
[Identify attack vectors specific to the organization's industry]

| Attack Vector | Exposure Level | Existing Controls | Control Effectiveness |
|---------------|----------------|-------------------|-----------------------|
| [Vector 1] | [High/Medium/Low] | [Controls] | [High/Medium/Low] |
| [Vector 2] | [High/Medium/Low] | [Controls] | [High/Medium/Low] |
| [Vector 3] | [High/Medium/Low] | [Controls] | [High/Medium/Low] |

---

## 5. Vulnerability Assessment

### 5.1 Critical Vulnerabilities

[List and describe critical vulnerabilities discovered during the assessment]

| ID | Vulnerability | Affected System(s) | Description | CVSS Score | Evidence |
|----|---------------|-------------------|-------------|------------|----------|
| CR-01 | [Vulnerability Name] | [System(s)] | [Description] | [Score] | [Evidence] |
| CR-02 | [Vulnerability Name] | [System(s)] | [Description] | [Score] | [Evidence] |

### 5.2 High-Risk Findings

[List and describe high-risk vulnerabilities discovered during the assessment]

| ID | Vulnerability | Affected System(s) | Description | CVSS Score | Evidence |
|----|---------------|-------------------|-------------|------------|----------|
| HR-01 | [Vulnerability Name] | [System(s)] | [Description] | [Score] | [Evidence] |
| HR-02 | [Vulnerability Name] | [System(s)] | [Description] | [Score] | [Evidence] |

### 5.3 Medium-Risk Findings

[List and describe medium-risk vulnerabilities discovered during the assessment]

| ID | Vulnerability | Affected System(s) | Description | CVSS Score | Evidence |
|----|---------------|-------------------|-------------|------------|----------|
| MR-01 | [Vulnerability Name] | [System(s)] | [Description] | [Score] | [Evidence] |
| MR-02 | [Vulnerability Name] | [System(s)] | [Description] | [Score] | [Evidence] |

### 5.4 Low-Risk Findings

[List and describe low-risk vulnerabilities discovered during the assessment]

| ID | Vulnerability | Affected System(s) | Description | CVSS Score | Evidence |
|----|---------------|-------------------|-------------|------------|----------|
| LR-01 | [Vulnerability Name] | [System(s)] | [Description] | [Score] | [Evidence] |
| LR-02 | [Vulnerability Name] | [System(s)] | [Description] | [Score] | [Evidence] |

---

## 6. Compliance Status

### 6.1 Regulatory Requirements

#### 6.1.1 Applicable Regulations
[List applicable regulations and legal requirements]

| Regulation | Applicability | Compliance Status | Major Gaps |
|------------|---------------|-------------------|------------|
| [Regulation] | [Applicability] | [Status] | [Gaps] |
| [Regulation] | [Applicability] | [Status] | [Gaps] |

#### 6.1.2 Regulatory Compliance Assessment
[Evaluate compliance with applicable regulatory requirements]

### 6.2 Industry Standards

#### 6.2.1 Applicable Standards
[List applicable industry standards and frameworks]

| Standard | Applicability | Compliance Status | Major Gaps |
|----------|---------------|-------------------|------------|
| [Standard] | [Applicability] | [Status] | [Gaps] |
| [Standard] | [Applicability] | [Status] | [Gaps] |

#### 6.2.2 Standards Compliance Assessment
[Evaluate compliance with applicable industry standards]

### 6.3 Internal Policies

#### 6.3.1 Policy Inventory
[List internal security policies and standards]

| Policy | Version | Last Review | Compliance Status |
|--------|---------|-------------|-------------------|
| [Policy] | [Version] | [Date] | [Status] |
| [Policy] | [Version] | [Date] | [Status] |

#### 6.3.2 Policy Compliance Assessment
[Evaluate compliance with internal policies and standards]

---

## 7. Incident Response Readiness

### 7.1 IR Plan Assessment

#### 7.1.1 IR Plan Review
[Review and evaluate the incident response plan]

| Component | Status | Adequacy | Gaps/Issues |
|-----------|--------|----------|-------------|
| Plan Structure | [Present/Absent] | [Adequate/Inadequate] | [Gaps/Issues] |
| Roles & Responsibilities | [Present/Absent] | [Adequate/Inadequate] | [Gaps/Issues] |
| Incident Classification | [Present/Absent] | [Adequate/Inadequate] | [Gaps/Issues] |
| Response Procedures | [Present/Absent] | [Adequate/Inadequate] | [Gaps/Issues] |
| Communication Plan | [Present/Absent] | [Adequate/Inadequate] | [Gaps/Issues] |
| Testing & Maintenance | [Present/Absent] | [Adequate/Inadequate] | [Gaps/Issues] |

#### 7.1.2 IR Plan Recommendations
[Provide recommendations to improve the incident response plan]

### 7.2 Team Readiness

#### 7.2.1 IR Team Structure
[Evaluate the structure of the incident response team]

#### 7.2.2 IR Team Skills and Training
[Evaluate the skills and training of the incident response team]

#### 7.2.3 IR Team Recommendations
[Provide recommendations to improve the incident response team]

### 7.3 Tools and Resources

#### 7.3.1 IR Tools Inventory
[Inventory and evaluate incident response tools and resources]

| Tool/Resource | Purpose | Effectiveness | Gaps/Issues |
|---------------|---------|---------------|-------------|
| [Tool] | [Purpose] | [High/Medium/Low] | [Gaps/Issues] |
| [Tool] | [Purpose] | [High/Medium/Low] | [Gaps/Issues] |

#### 7.3.2 IR Tools and Resources Recommendations
[Provide recommendations to improve incident response tools and resources]

---

## 8. Security Controls Assessment

### 8.1 Technical Controls

#### 8.1.1 Technical Controls Inventory
[Inventory and evaluate technical security controls]

| Control Category | Controls | Effectiveness | Gaps/Issues |
|------------------|----------|---------------|-------------|
| Preventive | [Controls] | [High/Medium/Low] | [Gaps/Issues] |
| Detective | [Controls] | [High/Medium/Low] | [Gaps/Issues] |
| Corrective | [Controls] | [High/Medium/Low] | [Gaps/Issues] |

#### 8.1.2 Technical Controls Recommendations
[Provide recommendations to improve technical security controls]

### 8.2 Administrative Controls

#### 8.2.1 Administrative Controls Inventory
[Inventory and evaluate administrative security controls]

| Control Category | Controls | Effectiveness | Gaps/Issues |
|------------------|----------|---------------|-------------|
| Policies & Standards | [Controls] | [High/Medium/Low] | [Gaps/Issues] |
| Procedures | [Controls] | [High/Medium/Low] | [Gaps/Issues] |
| Training & Awareness | [Controls] | [High/Medium/Low] | [Gaps/Issues] |
| HR Security | [Controls] | [High/Medium/Low] | [Gaps/Issues] |

#### 8.2.2 Administrative Controls Recommendations
[Provide recommendations to improve administrative security controls]

### 8.3 Physical Controls

#### 8.3.1 Physical Controls Inventory
[Inventory and evaluate physical security controls]

| Control Category | Controls | Effectiveness | Gaps/Issues |
|------------------|----------|---------------|-------------|
| Facility Access | [Controls] | [High/Medium/Low] | [Gaps/Issues] |
| Environmental | [Controls] | [High/Medium/Low] | [Gaps/Issues] |
| Physical Media | [Controls] | [High/Medium/Low] | [Gaps/Issues] |
| Monitoring | [Controls] | [High/Medium/Low] | [Gaps/Issues] |

#### 8.3.2 Physical Controls Recommendations
[Provide recommendations to improve physical security controls]

---

## 9. Risk Assessment

### 9.1 Risk Register

[Compile a comprehensive risk register based on assessment findings]

| ID | Risk Description | Affected Assets | Threat Source | Vulnerability | Inherent Risk | Existing Controls | Residual Risk |
|----|------------------|-----------------|---------------|---------------|---------------|-------------------|---------------|
| R-01 | [Description] | [Assets] | [Threat] | [Vulnerability] | [H/M/L] | [Controls] | [H/M/L] |
| R-02 | [Description] | [Assets] | [Threat] | [Vulnerability] | [H/M/L] | [Controls] | [H/M/L] |
| R-03 | [Description] | [Assets] | [Threat] | [Vulnerability] | [H/M/L] | [Controls] | [H/M/L] |

### 9.2 Impact Analysis

#### 9.2.1 Business Impact
[Analyze the potential business impact of identified risks]

| Risk ID | Financial Impact | Operational Impact | Reputational Impact | Regulatory Impact | Overall Impact |
|---------|------------------|--------------------|--------------------|-------------------|----------------|
| R-01 | [H/M/L] | [H/M/L] | [H/M/L] | [H/M/L] | [H/M/L] |
| R-02 | [H/M/L] | [H/M/L] | [H/M/L] | [H/M/L] | [H/M/L] |
| R-03 | [H/M/L] | [H/M/L] | [H/M/L] | [H/M/L] | [H/M/L] |

#### 9.2.2 Critical Asset Impact
[Analyze the potential impact on critical assets]

### 9.3 Likelihood Assessment

[Assess the likelihood of identified risks]

| Risk ID | Threat Capability | Vulnerability Exposure | Controls Effectiveness | Overall Likelihood |
|---------|--------------------|------------------------|------------------------|-------------------|
| R-01 | [H/M/L] | [H/M/L] | [H/M/L] | [H/M/L] |
| R-02 | [H/M/L] | [H/M/L] | [H/M/L] | [H/M/L] |
| R-03 | [H/M/L] | [H/M/L] | [H/M/L] | [H/M/L] |

---

## 10. Recommendations

### 10.1 Critical Actions

[Prioritized list of critical actions to address immediate security concerns]

| ID | Recommendation | Related Finding(s) | Priority | Complexity | Resource Requirements | Timeframe |
|----|----------------|---------------------|----------|------------|----------------------|-----------|
| CA-01 | [Action] | [Finding(s)] | Critical | [H/M/L] | [Requirements] | Immediate |
| CA-02 | [Action] | [Finding(s)] | Critical | [H/M/L] | [Requirements] | Immediate |

### 10.2 Short-term Improvements

[Recommendations for short-term security improvements (0-3 months)]

| ID | Recommendation | Related Finding(s) | Priority | Complexity | Resource Requirements | Timeframe |
|----|----------------|---------------------|----------|------------|----------------------|-----------|
| ST-01 | [Action] | [Finding(s)] | High | [H/M/L] | [Requirements] | 0-3 months |
| ST-02 | [Action] | [Finding(s)] | High | [H/M/L] | [Requirements] | 0-3 months |

### 10.3 Long-term Strategy

[Recommendations for long-term security strategy (3+ months)]

| ID | Recommendation | Related Finding(s) | Priority | Complexity | Resource Requirements | Timeframe |
|----|----------------|---------------------|----------|------------|----------------------|-----------|
| LT-01 | [Action] | [Finding(s)] | Medium | [H/M/L] | [Requirements] | 3-6 months |
| LT-02 | [Action] | [Finding(s)] | Medium | [H/M/L] | [Requirements] | 6-12 months |
| LT-03 | [Action] | [Finding(s)] | Low | [H/M/L] | [Requirements] | 12+ months |

---

## 11. Implementation Roadmap

### 11.1 Timeline

[Provide a visual timeline of recommended actions]

| Timeline | Critical Actions | Short-term Actions | Long-term Actions |
|----------|------------------|-------------------|-------------------|
| Immediate | [Actions] | | |
| 0-1 Month | [Actions] | [Actions] | |
| 1-3 Months | [Actions] | [Actions] | |
| 3-6 Months | | [Actions] | [Actions] |
| 6-12 Months | | | [Actions] |
| 12+ Months | | | [Actions] |

### 11.2 Resource Requirements

[Detailed resource requirements for implementing recommendations]

#### 11.2.1 Personnel Resources
[Personnel resources required, including roles, skills, and time commitments]

#### 11.2.2 Technology Resources
[Technology resources required, including hardware, software, and services]

#### 11.2.3 Budget Estimates
[Estimated costs for implementing recommendations]

| Category | Short-term (0-3 months) | Medium-term (3-6 months) | Long-term (6+ months) | Total |
|----------|--------------------------|--------------------------|----------------------|-------|
| Personnel | [Cost] | [Cost] | [Cost] | [Total] |
| Hardware | [Cost] | [Cost] | [Cost] | [Total] |
| Software | [Cost] | [Cost] | [Cost] | [Total] |
| Services | [Cost] | [Cost] | [Cost] | [Total] |
| Training | [Cost] | [Cost] | [Cost] | [Total] |
| Other | [Cost] | [Cost] | [Cost] | [Total] |
| **Total** | [Total] | [Total] | [Total] | [Grand Total] |

### 11.3 Budget Estimates

[Provide detailed budget estimates for implementing recommendations]

---

## 12. Appendices

### Appendix A: Detailed Scan Results

[Include detailed technical scan results, such as vulnerability scan reports, penetration testing results, etc.]

### Appendix B: Testing Methodology

[Provide detailed information about the testing methodology used during the assessment]

#### B.1 Vulnerability Assessment Methodology
[Describe the methodology used for vulnerability assessment]

#### B.2 Penetration Testing Methodology
[Describe the methodology used for penetration testing, if applicable]

#### B.3 Tools and Techniques
[List and describe the tools and techniques used during the assessment]

| Tool | Purpose | Configuration | Version |
|------|---------|--------------|---------|
| [Tool] | [Purpose] | [Configuration] | [Version] |
| [Tool] | [Purpose] | [Configuration] | [Version] |

### Appendix C: Evidence Collection

[Describe the evidence collection process and include relevant evidence]

#### C.1 Evidence Collection Methodology
[Describe the methodology used for evidence collection]

#### C.2 Evidence Inventory
[Provide an inventory of evidence collected during the assessment]

| ID | Evidence Type | Description | Collection Date | Collected By |
|----|---------------|-------------|-----------------|--------------|
| E-01 | [Type] | [Description] | [Date] | [Name] |
| E-02 | [Type] | [Description] | [Date] | [Name] |

### Appendix D: Risk Assessment Methodology

[Describe the risk assessment methodology used, including risk scoring criteria]

#### D.1 Risk Assessment Framework
[Describe the risk assessment framework used]

#### D.2 Risk Scoring Criteria
[Describe the criteria used for risk scoring]

##### Impact Criteria
| Level | Financial | Operational | Reputational | Regulatory |
|-------|-----------|-------------|--------------|------------|
| High | [Criteria] | [Criteria] | [Criteria] | [Criteria] |
| Medium | [Criteria] | [Criteria] | [Criteria] | [Criteria] |
| Low | [Criteria] | [Criteria] | [Criteria] | [Criteria] |

##### Likelihood Criteria
| Level | Criteria |
|-------|----------|
| High | [Criteria] |
| Medium | [Criteria] |
| Low | [Criteria] |

##### Risk Matrix
| Likelihood/Impact | Low Impact | Medium Impact | High Impact |
|-------------------|------------|---------------|-------------|
| High Likelihood | Medium | High | Critical |
| Medium Likelihood | Low | Medium | High |
| Low Likelihood | Low | Low | Medium |

### Appendix E: Compliance Frameworks Mapping

[Map assessment findings to relevant compliance frameworks]

| Finding ID | NIST CSF | ISO 27001 | [Other Framework] |
|------------|----------|-----------|-------------------|
| [ID] | [Mapping] | [Mapping] | [Mapping] |
| [ID] | [Mapping] | [Mapping] | [Mapping] |

### Appendix F: Remediation Resources

[Provide resources to assist with remediation of findings]

#### F.1 Remediation Guides
[Provide guides or references for remediating common issues]

#### F.2 Vendor Resources
[Provide vendor-specific resources for remediation]

#### F.3 Security Best Practices
[Provide references to security best practices]

### Appendix G: Glossary

[Provide a glossary of terms used in the assessment report]

### Appendix H: References

[List references and sources used in the assessment]

1. NIST Special Publication 800-115: Technical Guide to Information Security Testing and Assessment
2. NIST Special Publication 800-30: Guide for Conducting Risk Assessments
3. OWASP Testing Guide
4. CIS Critical Security Controls
5. [Other references]