# P86-Assess Sample Management Report

Client: Northstar Health  
Assessment: CIS Controls v8 readiness  
Audience: Management  
Status: Draft for human review

## Executive Summary

Northstar Health has a credible security governance foundation, but the assessment identified priority remediation around MFA coverage evidence, vulnerability remediation SLAs, and incident response follow-up actions.

P86-Assess links each management finding back to questionnaire answers, uploaded evidence, assessor review, and audit activity so the report remains defensible.

## Assurance Opinion

Draft opinion: limited assurance until high-priority remediation items are evidenced, reviewed, and accepted by the assessor.

## Risk Heatmap

| Severity | Likelihood | Impact | Count | Finding |
| --- | --- | --- | --- | --- |
| High | Medium | High | 1 | Vulnerability remediation SLA evidence is incomplete |
| Medium | Medium | Medium | 2 | MFA policy/export mismatch; incident response actions need closure evidence |

## Priority Actions

- Upload vulnerability remediation evidence showing owners, closure dates, and validation proof.
- Provide MFA export evidence proving enforcement for privileged and remote access users.
- Close tabletop action items and attach completion evidence.

## Claim Vs Proof Conclusion

The client claimed time-bound vulnerability remediation and MFA coverage. Uploaded evidence partially supports the claim, but the assessor should request stronger operating-effectiveness proof before final reliance.

## Evidence Appendix

| Evidence Request | Status | Uploaded File | AI Review | Recommendation |
| --- | --- | --- | --- | --- |
| Critical vulnerability remediation SLA tracker | Under review | northstar-critical-vulnerability-sla.csv | Partial, 74% | Request refreshed tracker with closure evidence |
| MFA policy export | Under review | northstar-mfa-policy-export.csv | Partial | Compare policy claims with platform enforcement |

## Human Review Notice

This sample is an AI-assisted draft. A qualified assessor must confirm all evidence, findings, severity ratings, limitations, and client-facing conclusions before issue.