CyberProva · product walkthrough
One working week: from an unanswered security question to a clear next action
This is the descriptive transcript of a silent recording of the running application. It is filmed in a simulated workspace: Northbridge Consulting Ltd, the people in it, its results and its documents are invented. The recording uses the Business plan. It is not a customer assessment, and it is not proof of a connection to a real Microsoft 365 tenant.
The company in the film is a 24-person consultancy in Exeter. Priya Raman runs operations there; Loop IT is the outside provider that looks after its systems.
Monday — signing in
The recording opens on the CyberProva sign-in page, which offers Continue with Microsoft: customers authenticate with their existing Microsoft 365 work account through Microsoft Entra ID, and CyberProva never sees the password. The sign-in itself happens on Microsoft's own pages, so the recording does not show it and does not complete one — the workspace it goes on to show is simulated.
Setup — connecting Microsoft 365
The Microsoft 365 connection page lists the read-only Microsoft Graph application permissions the assessment engine requests. An administrator approves them once, on Microsoft's own admin consent screen, and can withdraw consent at any time from the Microsoft 365 admin centre. The recording stops at this page: it does not open the consent screen or connect a real tenant.
Monday — rerunning the checks
On the assessments page she starts a new assessment run. The automated checks read Microsoft 365 settings through Microsoft Graph; the rest are matched against evidence a reviewer has accepted. The recording shows the run starting but does not complete it, because the simulated workspace has no tenant to query. The results shown next are the simulated workspace's existing results.
Monday — where the business stands
The board summary shows Northbridge's score and how many of its essential controls are supported by evidence or by an automated check. Three remain outstanding and stay visible rather than being rounded away. A score is not a security guarantee.
Monday — the missing piece
Thirteen of the sixteen essentials are in place. The backup restore test, check BC-01.04, is not one of them: no report has ever been produced. That tells the owner what to ask for, instead of treating an unverified control as a pass.
Monday — asking the provider
In the evidence centre she selects BC-01.04 and writes to Marcus at Loop IT for the last successful restore test, with the date and what was restored. Creating the request produces a provider upload link. The recording sends no real email.
Tuesday — the provider replies
The provider opens the link and uploads August's restore report. There is no account to create and no access to anything else in the workspace: the link is scoped to the single request and expires.
Wednesday — reading it before accepting it
Back in the evidence centre the request is reviewed and the document accepted. Accepting a document records a review decision. It shows a test was run in August; it does not change any Microsoft 365 setting, and it does not prove the next restore will work.
Wednesday — the action stays open
The remediation page assigns restore testing to Loop IT, records it as in progress and notes that the October test must be reassessed before the action is closed. The target date remains visible. Nothing closes itself.
Thursday — answering a client
A supplier assurance questionnaire shows drafted answers alongside what each one rests on: an automated observation, a reviewed document, a negative finding, or something not established at all. Editing and check-mapping controls are available on demand. The answers keep the assessment's outstanding items until a new assessment establishes a changed result.
Thursday — the board meeting
The film returns to the board summary: three priorities, each with a named owner and a date. It does not manufacture a score increase after an upload. The closing invitation is to start a free assessment and decide what to address with your own IT team or provider.
Start your free assessment View the sample board report (PDF)