ACE IT Solutions.ai Template · Security assessment report · Illustrative content

Template — illustrative content only. No client data, no real findings. aceitsolutions.ai

Assessment report · template

Identity & Access Control Assessment

Client	[Client legal entity]
Engagement reference	[SOW-YYYY-NNN]
Assessment window	[Start date] to [End date]
Frameworks referenced	SOX ITGC · ISO/IEC 27001:2022 · SOC 2 · NYDFS Part 500 · PCI DSS v4.0
Prepared by	[Lead architect], ACE IT Solutions · reviewed by [Practice lead]
Classification	Client confidential — distribution list in Appendix B
Version	[1.0] · [Date] · superseding [n/a]

1 · Executive summary

We assessed identity and access controls across [n] in-scope applications, the corporate directory and the privileged access estate. Control design is sound in authentication and change management. The material exposure sits in the entitlement model: access is granted per application rather than per job function, which makes periodic review unreliable and leaves segregation-of-duties conflicts invisible at the point of request.

Of [n] findings, [n] are rated high, [n] medium and [n] low. Two of the high-rated findings are the documented root cause of prior-year audit observations, which means closing them addresses both this assessment and the open audit actions. None of the findings requires new platform procurement; all can be addressed with the tooling already licensed.

2 · Scope and limitations

In scope: [list applications, directories, PAM platform, cloud tenancies and business units]. Assessment covered control design and, where records existed, operating effectiveness over the stated window.

Out of scope: [list exclusions and the reason for each]. Excluded systems are named so that neither party treats this report as broader assurance than it is.

Limitations: conclusions rest on the evidence provided during the window and on interviews with named control owners. Where a control could not be tested, the finding states so rather than inferring effectiveness. This assessment is not an audit, and it does not constitute an attestation or a certification opinion.

3 · Method

Document review, configuration inspection, entitlement extraction and analysis, control-owner interviews, and sample testing of [n] provisioning, [n] leaver and [n] privileged-elevation events. Findings were rated on impact and likelihood, then cross-checked against the framework references above and the prior-year observation register.

RATING	DEFINITION	EXPECTED RESPONSE
High	Control absent or ineffective where failure would be reportable, or a repeat of a prior audit observation.	Remediation plan within 30 days; interim compensating control documented.
Medium	Control operates but evidence is incomplete, inconsistent or manually assembled.	Scheduled into the current or next quarter's plan with a named owner.
Low	Control effective; hygiene, efficiency or documentation improvement available.	Backlog item; no compensating control required.

4 · Control maturity summary

CONTROL DOMAIN	CURRENT	TARGET	PRIMARY GAP
Authentication and MFA	[3]	[4]	Exception population not time-bound
Entitlement and role model	[1]	[4]	Application-level grants, no business-language roles
Joiner-mover-leaver	[2]	[4]	Leaver revocation depends on manual notification
Privileged access	[2]	[4]	Credentials vaulted but entitlements standing
Access review and certification	[2]	[4]	Reviewers cannot interpret what they approve
Segregation of duties	[1]	[3]	No ruleset enforced at request time
Non-human identities	[1]	[3]	No sponsor, expiry or rotation lifecycle
Logging and monitoring	[3]	[4]	Identity events not correlated with privileged sessions

Maturity scale: 1 initial · 2 developing · 3 defined · 4 managed · 5 optimised. Target levels are agreed with the client, not imposed.

5 · Findings register

REF	FINDING	RATING	FRAMEWORK REF	OWNER
F-01	Entitlements granted per application, with no business-language role model	High	SOX ITGC · A.5.15 · CC6.1	[Owner]
F-02	Leaver revocation not triggered from the authoritative HR source	High	SOX ITGC · CC6.3 · 500.7	[Owner]
F-03	Standing privileged entitlements retained after credential vaulting	High	500.7 · PCI Req. 7 · A.8.2	[Owner]
F-04	Segregation-of-duties conflicts detected only in periodic review, not at request	Medium	SOX ITGC · A.5.3	[Owner]
F-05	Service and application accounts without sponsor, expiry or rotation	Medium	PCI Req. 8.6 · A.5.16	[Owner]
F-06	MFA exceptions granted without expiry or compensating control record	Medium	500.12 · PCI Req. 8	[Owner]
F-07	Privileged session records not retained for the period the framework expects	Low	PCI Req. 10 · A.8.15	[Owner]

6 · Worked finding

7 · Remediation roadmap

WINDOW	WORKSTREAM	CLOSES	DEPENDENCY
Weeks 1–4	HR-triggered leaver automation; MFA exception expiry enforced	F-02, F-06	HR data quality sign-off
Weeks 3–10	Entitlement discovery and role catalogue with business sign-off	F-01	Business owner availability
Weeks 6–12	Just-in-time privileged elevation; standing entitlements removed	F-03, F-07	Change freeze calendar
Weeks 10–16	SoD ruleset enforced at request; non-human identity lifecycle	F-04, F-05	Role catalogue complete
Weeks 14–18	Evidence pack assembly and control-owner rehearsal	All	Audit calendar

Appendix A · Evidence requested and received

A line-by-line list of every artefact requested, the date received, and the items outstanding at report date. Outstanding items are stated explicitly rather than omitted, so the reader can see the boundary of the conclusions.

Appendix B · Distribution and interviews

Named recipients and their roles; interview log with role, date and topics covered.

© 2026 ACE IT Solutions. ACE IT Solutions — an Autharva company. Template document with illustrative content; it describes no real client, engagement or finding. An assessment is not an audit and does not constitute an attestation or certification opinion. Certification is granted solely by accredited certification bodies.