Palette Tools
What the report looks like
A worked example for a fictional company, rendered by the same code that produces the real thing. The figures are invented; the structure is exactly what you receive.
This is an example, not a real assessment
Every figure below is made up, for a company that does not exist.
Poor
NIST Cybersecurity Framework 2.0
Grade D — Poor
25 of 25 questions answered across 6 domains. Overall this sits at Moderate Risk, with Detect the weakest area at 41%.
Scored from self-reported answers. Palette has not verified any of them.
Domain scores
Govern
72% · C
Identify
68% · D
Protect
55% · F
Detect
41% · F
Respond
58% · F
Recover
74% · C
The same figures, as a table
| Domain | Score | Grade | Standing |
|---|---|---|---|
| Govern | 72% | C | Fair |
| Identify | 68% | D | Poor |
| Protect | 55% | F | Critical Risk |
| Detect | 41% | F | Critical Risk |
| Respond | 58% | F | Critical Risk |
| Recover | 74% | C | Fair |
What to fix first
4 answers came back below full compliance, heaviest first.
Protect · answered No
Is multi-factor authentication (MFA) enforced for all user accounts, including remote access and privileged accounts?
Deploy MFA using Microsoft Authenticator, Duo, or Okta. Prioritize privileged accounts and remote access. This single control blocks over 99% of account compromise attacks.
Detect · answered No
Do you aggregate security logs centrally and review them for suspicious activity?
Deploy a SIEM (Microsoft Sentinel, Splunk, or AWS Security Hub). Define alert thresholds for critical events. Retain logs 12+ months.
Identify · answered Partially
Do you maintain a current inventory of all hardware and software assets in your environment?
Build an asset inventory before anything else — you cannot patch, monitor, or contain what you do not know you own. Start from your identity provider and network scans, then reconcile against procurement records.
Protect · answered Partially
Are user access rights reviewed at least quarterly, with prompt removal upon employee termination?
Implement quarterly access reviews using your IdP. Automate deprovisioning with HR system integration.
This is a brief, not an audit
The brief covers the basic components of each major domain — roughly 30% of a full assessment. It is built entirely from what you told it: Palette Technologies has not independently verified, validated or audited any answer, and a self-assessment is not an audit, a certification, or a legal opinion on your compliance.
A full engagement is the other 70%: every control in scope, evidence collection, control testing, gap analysis and an audit-ready report package, run by our team.
Your company’s first assessment is included
Register with your work email and run any of the four frameworks. Every assessment after the first is $200, paid once, with no subscription.
Start your free assessment