Samples
What the work looks like
A finding, a risk memo, and a POA&M excerpt, in the shape I deliver them. Conclusion first, method stated, an owner and a date on every item.
Sample 1 · Finding
Privileged accounts outside the MFA policy
Condition. 7 of 22 accounts in the Domain Admins group (32%) authenticate with a password alone. The oldest has had no MFA since it was created on 3 Feb 2024.
Criteria. NIST SP 800-171 Rev 2, 3.5.3: multifactor authentication for local and network access to privileged accounts. CMMC Level 2 practice IA.L2-3.5.3.
Cause. MFA is enforced by a conditional access policy scoped to the Staff group. The seven accounts are service and break-glass accounts created outside that group. The policy works exactly as built; it was scoped to people, and the gap is everything that is not a person.
Effect. Seven credentials with domain-wide rights are protected by a password only. Any one of them is the whole network. Sign-in logs for the 30-day window show no use from an unknown location for any of the seven. That is luck, not control.
What I tested. Pulled the full Domain Admins membership (n=22) from Active Directory on 14 Oct 2026. Checked every account, not a sample, against 30 days of sign-in logs for an MFA claim. Did not rely on the MFA coverage report, which showed 100% because it reads the same policy.
What operated well. Every account inside the Staff group enforced MFA on every sign-in in the window, 1,140 of 1,140. The control is good in its kind. Its defect is scope.
Recommendation. Scope the policy by privilege, not by group membership: every member of Domain Admins, present and future. Service accounts that cannot do MFA get a documented exception with a compensating control (restricted logon hosts, 24-hour credential rotation) and an owner. Adding the seven accounts to the Staff group by hand would close the symptom and leave the cause.
Owner and date. IT lead. Policy change by 28 Oct 2026, exceptions documented by 4 Nov 2026.
Sample 2 · Risk acceptance memo
Shop-floor CNC controller on an unsupported OS
Recommend accepting the residual risk on the shop-floor CNC controller (CNC-01) until replacement on 15 Jan 2027, with the operations manager as owner.
CNC-01 runs Windows 7 because the controller vendor’s software has no supported path to a newer OS. It talks to one file server over SMB to receive part files and nothing else. It has no internet route, no email client, and no removable media in use; the USB ports are disabled in BIOS and the BIOS is password protected. It sits on its own VLAN with one firewall rule inbound, from the file server, on one port.
The controls assume the file server stays clean. That is the assumption this memo rests on. The file server is patched monthly, runs EDR, and the share CNC-01 reads is write-limited to two accounts.
Alternatives considered. Upgrading the OS: not possible, the vendor software does not run on it. Air-gapping with USB transfer: reintroduces removable media, the larger risk. Replacing the controller now: $38,000 against a budgeted replacement in January; a 90-day exposure does not justify pulling it forward.
Residual risk even with the controls. A compromise of the file server reaches CNC-01. Detection is the EDR on the file server, not anything on CNC-01, which cannot run it.
Accept until 15 Jan 2027. Owner: operations manager. Review if the replacement date slips.
Sample 3 · POA&M excerpt
Three open items, ordered by risk
Each row starts with the gap it closes and ends with the evidence that proves it closed. A row without evidence of closure is a to-do, not a plan.
| ID | Weakness | 800-171 | Action | Owner | Due | Evidence of closure | Status |
|---|---|---|---|---|---|---|---|
| POAM-01 | 7 privileged accounts outside the MFA policy | 3.5.3 | Rescope the conditional access policy to every member of Domain Admins; document exceptions with compensating controls | IT lead | 28 Oct 2026 | Policy export plus a 30-day sign-in log showing an MFA claim on all 22 accounts | Open |
| POAM-02 | Audit logs retained 30 days; policy requires one year | 3.3.1 | Extend SIEM retention to 365 days | Sysadmin | 15 Nov 2026 | Retention setting export, then a query on day 31 returning an event older than 30 days | Open |
| POAM-03 | Terminated-user feed reads one of three HR termination types | 3.1.1 | Extend the HR feed to involuntary and contractor-end types | HR systems | 30 Nov 2026 | Feed configuration plus a reconciliation of the 90-day termination list against Active Directory with zero exceptions | Open |
Want yours in this shape?
Fifteen minutes, free. Tell me what you are being assessed on and when.