One assessment issues views of the same committed picture. It does not run the assessment again for management, engineering, or a vendor.
Report
Who it is for
What is in it
Executive
Leadership
This organisation’s residual, how that compares with appetite, material risks with why, and suggested remediation. Unassessed vendor implementation is transferred. It is not rolled into this score.
Engineering
Engineers
Architecture, the threat model, the risk register, control assessment, and remediation. Same organisational residual as the executive report.
Control register
Control owners
Every in-scope ISO control. Vendor-held rows are included under the vendor’s name. Each row has a component count and the related threats. An appendix lists controls that are not applicable or still waiting on a scope fact.
Overall risk
Risk owner
Combined residual: this organisation plus accepted vendor answers. Each risk names the party and the source.
Overall compliance
Compliance
Combined control status: organisational implementation plus accepted vendor compliance, with provenance on each row. Submitted answers you have not accepted stay unknown.
Vendor control assessment
That vendor
One file per named vendor. Their controls, what each control requires, transferred risks, and outstanding items. You can send that vendor only their file.
Print/PDF is the browser print of that view. Markdown and Word render the same snapshot. JSON is the full typed document.
Report downloads in Phase 9
Same Phase 9 card as report configuration. Vendor files are one per named vendor.
Each named vendor gets its own file. Overall risk and overall compliance include accepted vendor answers.
What a serious buyer should look for
Findings trace to a system model and control points, not a free-form essay.
Missing evidence is visible (UNKNOWN), not painted as green.
A vendor’s controls are named on the register, and their file is separate. Their answers change the overall reports only after you accept them.