Sample document: the company, findings and data are fictional. It shows the structure and level of detail of our reports.
cybercaribouVersion 1.0 · Confidential
Cybersecurity audit report
Example CPA Firm Inc.
Fictional accounting firm · 24 employees · Laval
- Audit period: October 6–17, 2026
- Version 1.0 · Confidential
- Authorization reference: EX-2026-014
1. Executive summary
Current risk level
High
After the 3 priorities
Moderate
The firm has good foundations: daily backups, up-to-date antivirus on every device, and a generally well-run Microsoft 365. Three weaknesses, however, directly expose clients’ tax data and the firm’s money: accounts without multi-factor authentication, backups that ransomware could encrypt, and an email domain that is easy to spoof for payment fraud.
Your 3 priorities for the next 30 days
- 1.Enable multi-factor authentication on the 6 Microsoft 365 accounts that lack it, including the 2 administrator accounts.
- 2.Isolate a copy of the backups off the main network (immutable or offline) and test a full restore.
- 3.Move the DMARC policy from “monitor” to “quarantine”, then “reject”.
Estimated effort : About 3 person-days, shared between the firm and its IT provider.
Findings by severity
Critical · 1High · 3Medium · 5Low · 4
2. Scope and method
In scope
- Domain and Internet-facing services
- Microsoft 365 tenant (read-only access)
- Sample of 5 workstations and the file server
- Office Wi-Fi network
- Interviews: managing partner and IT provider
Out of scope
- Active internal penetration testing
- Third-party applications hosted by vendors
- Physical security beyond observation
Method and frameworks
- Interviews and document review
- Microsoft 365 configuration review
- Passive external analysis and manual checks
- Frameworks: NIST CSF 2.0, Canadian Centre for Cyber Security baseline controls, Law 25
Authorization
Authorization letter signed by the managing partner on October 3, 2026, stating scope, dates and contacts.
3. Findings overview
| ID | Finding | Severity | Effort | Due |
|---|---|---|---|---|
| C-01 | Microsoft 365 accounts without multi-factor authentication, including 2 admins | Critical | Low | 7 days |
| H-02 | Backups reachable from the main network | High | Medium | 30 days |
| H-03 | DMARC in monitor mode (p=none) | High | Low | 30 days |
| H-04 | Automatic forwarding rule to an external address | High | Low | 7 days |
| M-05 | Laptops without disk encryption (2 of 5) | Medium | Low | 60 days |
| M-06 | Guest Wi-Fi on the same network as workstations | Medium | Medium | 60 days |
| M-07 | Former employees’ accounts still active (2) | Medium | Low | 7 days |
| M-08 | No confidentiality incident register | Medium | Low | 30 days |
| M-09 | Third-party software patches behind on 3 devices | Medium | Medium | 60 days |
| L-10 | Missing security headers on the website | Low | Low | 90 days |
| L-11 | Web server version disclosed | Low | Low | 90 days |
| L-12 | No security.txt file | Low | Low | 90 days |
| L-13 | Undocumented password policy | Low | Low | 90 days |
4. Detailed findings (excerpt)
C-01Critical
Microsoft 365 accounts without multi-factor authentication
- Description
- Six of 24 accounts have no multi-factor method registered. Two of them hold the Global Administrator role.
- Impact for the firm
- One password stolen by phishing is enough to read clients’ tax files, send fake invoices from a legitimate address or, with an admin account, take over the whole tenant.
- Evidence
- MFA registration report (anonymized excerpt): 6 users with no method registered, including admin-1 and admin-2 (Global Administrator). Legacy authentication still allowed.
- Recommendation
- Require MFA for every account through a conditional access policy (or security defaults).
- For administrators, prefer FIDO2 keys or passkeys over SMS.
- Block legacy authentication.
- Create separate admin accounts with no mailbox.
- References
- NIST CSF 2.0 PR.AA · Canadian Centre for Cyber Security baseline controls (authentication)
H-02High
Backups reachable from the main network
- Description
- Daily backups are written to a NAS mapped as a network drive on the file server. No copy is offline or immutable, and no full restore has been tested.
- Impact for the firm
- Ransomware reaching the server would also encrypt the backups. The firm could not resume work during tax season without paying or rebuilding everything.
- Evidence
- Network drive mapped to the NAS on the server; same read-write service account; restore log: no test recorded.
- Recommendation
- Apply the 3-2-1-1-0 rule: at least one immutable or offline copy.
- Remove the mapped drive and use a dedicated backup account.
- Test a full restore every quarter and record the result.
- References
- NIST CSF 2.0 PR.DS, RC.RP · Canadian Centre for Cyber Security guidance on backups
H-03High
DMARC in monitor mode
- Description
- The domain publishes a DMARC policy at p=none: emails spoofing the firm’s address are delivered normally.
- Impact for the firm
- A fraudster can send your clients a payment request that appears to come from your exact address, a common payment-fraud scenario.
- Evidence
- _dmarc.example-cpa.example: “v=DMARC1; p=none; rua=mailto:…”; SPF at ~all; DKIM enabled for Microsoft 365, missing for the newsletter platform.
- Recommendation
- Enable DKIM for the newsletter platform.
- Review DMARC reports for 3 to 4 weeks.
- Move to p=quarantine, then p=reject.
- References
- RFC 7489 (DMARC) · Gmail, Yahoo and Outlook sender requirements
5. Roadmap
30 days
- MFA for everyone (C-01)
- Remove the forwarding rule (H-04)
- Disable former employees’ accounts (M-07)
- Open the incident register (M-08)
60 days
- Immutable backup copy and restore test (H-02)
- DMARC at quarantine (H-03)
- Laptop encryption (M-05)
- Separate guest Wi-Fi (M-06)
90 days
- DMARC at reject
- Third-party patch management (M-09)
- Security headers and security.txt (L-10 to L-12)
- Password policy (L-13)
6. Law 25 — security side
- Privacy officer designated and publishedCompliant
- Privacy policy published on the websiteCompliant
- Confidentiality incident registerTo create (M-08)
- Assessment and CAI notification procedureTo write
- Privacy impact assessment for the new client portalStarted, to complete
- Reasonable security safeguardsSee C-01 and H-02
7. Next steps
- Results walkthrough with the managing partner and IT provider (1 hour, on-site).
- Remediation support on request, on quote.
- Retest of Critical and High findings in 60 days.