Reports and documentation

A security report summarises the security posture at a given point in time. It is based only on observations Värn has recorded and information you have entered yourselves.

Contents

1. Management summary
2. Scope and coverage – which assets were assessed
3. Critical and high findings
4. Risk register with all active findings and accepted risks
5. Recommended actions
6. Changes during the period
7. Data breaches
8. Limitations of the assessment and checks that could not be carried out
9. Mapping to frameworks (NIS2, GDPR, ISO/IEC 27001)
10. Evidence and timestamps – which scans the report is based on

Three kinds of information

The report clearly separates:

• Confirmed observation – something Värn observed directly, for example that a header is missing.
• Assessed risk – a conclusion based on indirect evidence, marked as likely or possible.
• Not assessed – checks that could not be carried out. They are reported openly and never count as passed.

Versions and integrity

Every report is stored as an immutable snapshot with a version number and a checksum (SHA-256). The texts are frozen when the report is created, so a report from the spring looks exactly the same in the autumn. No user can change its content afterwards.

Export

Open the report and choose Print / save as PDF. The layout is designed for A4.