Microsoft 365 security guide
Board cyber security reporting with evidence and clear priorities
Directors need to understand what could disrupt the business, what evidence supports the current position and which decisions need their attention. A board cyber security report should turn technical findings into priorities while keeping uncertainty and the limits of the assessment visible.
Published · Last reviewed · By CyberProva
Run your free Microsoft 365 security assessmentNo card required · Optional read-only Microsoft 365 connection
Lead with the business decision
Start with the services and information the business depends on. Explain the significance of a finding in that context and distinguish a potential risk from an incident that has actually occurred.
- State the assessment date, scope and important exclusions.
- Identify the findings that need management attention and explain the plausible business impact.
- Name the decision required, such as assigning responsibility, approving work or requesting further investigation.
Show the evidence behind the position
A headline score is a summary of selected checks. Directors also need to know whether a statement comes from a settings check, reviewed provider evidence or an unanswered question.
- Separate automated observations from evidence accepted by your organisation.
- Make missing evidence and licensing or permission gaps visible.
- Explain whether progress reflects a verified change, new evidence or a different assessment scope.
- Support recovery claims with completed test records rather than a policy alone.
Close with owners and follow-up
Keep the board discussion focused on a small set of decisions. Management should agree the owners and dates and return with evidence of completion.
- Record the agreed next action for each important finding.
- Identify who will obtain missing evidence or implement a change.
- Agree a review date and any issue that should be escalated sooner.
- Use comparable scope and evidence when discussing changes between reports.
Where to check this in Microsoft 365
Ask your authorised administrator to inspect these areas for the accounts, services and devices in scope. These are review locations, not instructions to change settings without a plan.
Posture recommendations: Microsoft Secure Score
Microsoft Defender portal: Secure Score, including the improvement actions and their supporting status. Review those actions against the business scope rather than a target percentage alone.
Administrator access: Entra roles and PIM
Microsoft Entra admin centre: Entra ID > Roles & admins for current assignments; ID Governance > Privileged Identity Management for eligible access and activation settings where licensed.
PIM needs Entra ID P2 or Entra ID Governance for relevant users. It is not included simply because a tenant has Business Premium/P1. Emergency-access readiness needs human review.
Recovery: Exchange/SharePoint retention and backup
Microsoft Purview: Data Lifecycle Management > Retention policies and relevant retention labels; review Exchange deleted-item and SharePoint/OneDrive recycle-bin/restore settings with the administrator. Inspect the separate backup service and its recovery records.
Retention, version history and recycle bins offer different recovery functions. Do not assume they are equivalent to an independently managed backup or satisfy the insurer's definition. Confirm the licensed recovery features and actual restore requirements.
What CyberProva can check automatically
Read-only observations depend on the selected plan, Microsoft licensing, consent and available data. Missing access is a gap, not a pass. Review the documented permissions and deployment limitations.
- Posture recommendations: Microsoft Secure Score: Core assessments read available Microsoft Secure Score information. CyberProva's Cyber health summary uses its own selected checks; it is not Microsoft's score or a breach-probability calculation.
- Administrator access: Entra roles and PIM: Core: current directory-role assignments and Global Administrator principals. Advanced: supported standing-access observations when the required sources are available. Core counts do not resolve group membership or all eligible PIM access.
- Recovery: Exchange/SharePoint retention and backup: CyberProva does not automatically validate retention coverage, backup isolation or restore success. Recovery controls require supplied records and organisation review.
What you should request from your IT provider
Keep the source, date, scope, exceptions and reviewer with each record. Submission and acceptance are separate; your organisation decides whether the evidence supports the claim.
- Posture recommendations: Microsoft Secure Score: A dated recommendation export, the configuration behind actions marked complete, scope/exceptions and a separately reviewed action plan. Explain missing evidence alongside the headline score.
- Administrator access: Entra roles and PIM: Role assignments, separate admin-account records, PIM activation and approval requirements where used, and reviewed emergency-access custody, monitoring and test records. A named role does not establish business need.
- Recovery: Exchange/SharePoint retention and backup: Retention/deletion scope, backup workload coverage and retention, administrative separation or isolation/immutability where claimed, and a dated restore test with restored data, result, failures and reviewer.
Make the answer provable
Evidence pack for this guide
- An assessment scope, date and concise explanation of important findings.
- Supporting settings observations, reviewed provider evidence and explicit gaps.
- A management action list and the decisions being requested from directors.
How CyberProva helps
CyberProva provides an on-screen summary of selected findings and evidence gaps. Business and above add board-report exports and remediation management to support your review. Management still supplies the business context, agrees responsibilities and approves the paper. Free includes 3 lifetime core assessments; scheduled monitoring requires Professional or above.
See what a Microsoft 365 security assessment should cover →
See exactly what CyberProva checks · Learn how CyberProva assesses security · Review Microsoft permissions
Practical example
Example board discussion: recovery evidence is missing
Illustrative discussion prompts, not an automated conclusion about your business. Use the public sample report below to see the report format.
- Position: a backup process is described, but a completed restore-test record for the agreed scope has not been reviewed.
- Business question: which services depend on that data, and what disruption would a failed recovery cause?
- Decision requested: ask management to arrange a scoped restore test with the IT provider and confirm who owns the follow-up.
- Next review: obtain the dated test result, explain any exclusions and agree actions for failures.
View the sample board report (PDF)
Illustrative data. No email or account required. Your own report exports require Business or above.
What this cannot establish
- Reports summarise the selected assessment and evidence held. They do not establish complete security, quantify breach probability or provide independent audit assurance.
- Business impact, risk acceptance and management commitments require human judgement. A report does not itself implement the agreed controls.
Common questions
Can we see a board report before signing up?
Yes. The sample board report linked below is public and uses illustrative data. It shows the format; it is not evidence about your organisation.
Is the board report included in Free?
Free includes an on-screen summary. Exportable board reports and remediation management require Business or above.
Does a high Cyber health score mean the business is secure?
No. The score summarises selected controls within the assessment scope. Directors should review the underlying findings, evidence gaps and wider business risks.
Will the report cover every board responsibility?
No. It supports discussion of selected technical controls and evidence. Wider governance, legal obligations, incident planning and business risk decisions need their own review.
Official guidance
Use these sources with your IT provider when reviewing the controls described above.
From assumptions to evidence
See what needs attention in your organisation
Start with a free CyberProva assessment. Review the findings, identify evidence gaps and agree priorities with your IT team.
Free includes 3 lifetime core assessments. Report exports and advanced features require a paid plan.