Incident Response Readiness Sample Report
What you receive, shown on a fictional dental group: scores by area, findings, business risks and a 90-day roadmap.
A readiness score your owner can follow
Five areas, the top business risks and what to fund first, in plain language.
Evidence your IT lead can act on
Each of the 17 controls with its rating, the evidence behind it and the next step.
Four reports and a framework mapping
Word and PDF versions of every report. This page shows short extracts from a fictional company.
| Deliverable | What it contains | Who uses it |
|---|---|---|
| Executive readiness report | Overall readiness, the top risks and what to fund first | Owner, CEO, board |
| Control scorecard | All 17 controls with their rating and evidence | IT manager, compliance lead |
| Risk register | Business risks rated by likelihood and impact, tied to findings | Compliance, insurer, auditors |
| 90-day roadmap | Actions in order with owners | IT manager, vCISO |
| Framework mapping | Each control mapped to your frameworks | Auditors, assessors |
A fictional dental group with three offices
Every name and number on this page is made up and shows the format only. Your report uses the evidence from your own business.
- Company
- Brightmere Family Dental (fictional company), 3 offices, 46 employees
- Systems
- Microsoft 365, a cloud practice-management system, imaging servers in each office
- IT support
- An outside managed IT provider
- Frameworks
- HIPAA Security Rule; California breach notification law; cyber insurance renewal in 4 months
Readiness by area
Share of controls rated Documented or Tested, weighted by importance. Below 50 critical exposure, 50–70 needs improvement, 70–85 fair, 85+ good.
| Area | Score | Band | |
|---|---|---|---|
| Governance and decision authority | 38 | Critical exposure | |
| Detection, logging and evidence | 46 | Critical exposure | |
| Communication and notification | 29 | Critical exposure | |
| Recovery and continuity | 52 | Needs improvement | |
| Testing and improvement | 21 | Critical exposure |
Sample findings
| Area | Finding | Severity |
|---|---|---|
| Governance | No written incident response plan; roles exist only by habit | Critical |
| Communication | No notification decision tree for HIPAA and California deadlines | Critical |
| Governance | No one is named to decide on shutting systems down or calling the insurer | High |
| Communication | Insurer incident line and breach counsel are not on any contact list | High |
| Evidence | Microsoft 365 audit log retention never reviewed; no log-source inventory | High |
| Recovery | Restores have never been tested against recovery targets set by the practice | High |
| Testing | No tabletop exercise in the last 12 months | High |
| Recovery | Practice-management SaaS contract has no incident-notice clause | Medium |
| Communication | No way to reach staff if email and Teams are unavailable | Medium |
Findings rolled up into business risks
Score = likelihood × impact. Critical 20–25, High 12–19, Medium 6–11, Low 1–5.
| ID | Business risk | Rating | Score |
|---|---|---|---|
| R-01 | Missed notification deadlines after a breach of patient data | Critical | 4 × 5 = 20 |
| R-02 | Slow, disputed decisions in the first hours of a ransomware event | High | 4 × 4 = 16 |
| R-03 | Extended downtime because restores were never tested against agreed targets | High | 3 × 5 = 15 |
| R-04 | Investigation limited by missing or expired logs | Medium | 3 × 3 = 9 |
The 90-day roadmap
The most serious gaps close first. Owners and dates are agreed with the client.
Phase 0
Name the incident lead and alternates; put the insurer line and counsel on a contact sheet kept offline.
Phase 1
Write the plan and the notification decision tree with counsel; agree recovery targets with the practice owners.
Phase 2
Review log retention with the IT provider; test a restore against the agreed targets; add an out-of-band channel.
Phase 3
Run a ransomware tabletop; add incident-notice clauses at vendor renewal; update the plan from the lessons.
Extract from the mapping
| Finding | Framework reference |
|---|---|
| No written incident response plan | HIPAA 164.308(a)(6); NIST CSF 2.0 RS.MA |
| Restores not tested against agreed targets | HIPAA 164.308(a)(7) testing and revision; NIST CSF 2.0 RC.RP |
| No notification decision tree | California Civil Code 1798.82; HIPAA Breach Notification Rule |
| No tabletop in 12 months | NIST CSF 2.0 ID.IM; cyber insurance renewal questions |
All sample companies, systems and findings on this page are fictional and used for illustration only. Framework references are general information, not legal advice. The assessment is read-only and does not promise data retention, restore times or recovery outcomes.
See your own readiness score
Schedule a consultation. The incident response readiness assessment is $3,500 fixed.
Read-only, independent and vendor-neutral. On-site across Irvine, Orange County and Southern California; remote nationwide.