By Phantom PenTest · Published
1. Executive Summary
Illustrative engagement scope
Facility: Fictional Office A. Review focus: employee access removal and the handling of visitor exceptions. The example assumes a document review, stakeholder interviews and an agreed walkthrough. It does not represent a controlled entry attempt, a review of every access record or a technical test of every security system.
Example leadership overview
In this fictional scenario, written instructions assign responsibility for access removal, but the process does not consistently record confirmation that the change has been completed. Visitor exceptions are handled by reception staff, while the relevant escalation contact is not clearly identified in the available procedure.
These example conditions suggest a need to clarify responsibility and completion checks before considering additional technology. The objective is a repeatable process that leadership can verify. This sample does not establish that unauthorized access occurred.
Decisions requested
- Assign an accountable owner for access-removal verification.
- Approve a review of current access permissions within an agreed scope.
- Clarify the visitor-exception escalation contact and communicate the procedure.
- Agree how completion evidence and unresolved exceptions will be reviewed.
2. Risk-Ranked Finding, Evidence & Recommendations
ILL-01: Access removal lacks a recorded completion check
Illustrative priority: Medium. This label applies only to the assumptions in this fictional example. It is not a rating of a real facility or a universal severity for this type of issue.
Observed condition, invented for this sample: the access-removal workflow identifies who requests a change but does not require confirmation from the administrator that permissions were removed. A request may therefore be treated as closed before implementation has been verified.
Potential consequence: permissions that are no longer needed could remain active. The significance depends on the areas accessible, how long access remains available and the other safeguards operating at the facility.
Assumed existing safeguards: a designated access administrator, restricted access groups and periodic management review. The example assumes these safeguards exist; it does not verify their effectiveness.
How evidence should be referenced
A real report should identify the evidence supporting the condition and distinguish documents, interviews and direct observations. References should allow an authorized reviewer to understand the basis of the finding without unnecessarily distributing sensitive information.
- ILL-E01 — fictional document reference: an example access-removal procedure with no completion-confirmation step.
- ILL-E02 — fictional workflow reference: an example request record showing a request status without an administrator completion field.
- Evidence limitation: no live credentials, real records, photographs, facility layouts or interview statements were collected for this public sample.
Recommended action in the example
Assign responsibility for implementing the change and separately define how completion is confirmed. Record unresolved requests as open exceptions, with an owner and an escalation route. Review current permissions through an authorized process to identify access that no longer has a valid business purpose.
Suggested verification: trace an agreed sample of subsequent access changes from request through implementation and confirmation. Verify the outcome in the relevant administrative record, rather than relying only on the request being marked complete. The sample size, access arrangements and verification method belong in the agreed follow-up scope.
Why explain the risk rationale?
A label alone does not tell leadership what to do. Explain the exposure, potential consequences, existing safeguards and uncertainty behind the priority. Our guide to prioritizing physical security findings describes that decision process.
3. Leadership Debrief
The debrief connects the report to decisions. In this example, the discussion would clarify who owns access-removal completion, which procedures need revision, what information is still missing and how leadership will know the change is working.
- Explain each priority and the evidence supporting it.
- Separate immediate process changes from longer-term improvements.
- Confirm who owns actions and who can approve resources.
- Record questions, dependencies and any disagreement about the assumptions.
- Agree when progress will be reviewed and what constitutes closure.
The debrief should also explain the limits of the engagement. An observation-led assessment does not establish how every control would perform under an attempted breach. Assessments and controlled physical testing answer different questions.
4. Remediation Roadmap
The example roadmap turns the finding into assigned work. Timing and ownership below are illustrative planning steps; they are not prescribed deadlines for a real organization.
Agree the action and owner
Owner: the designated security program lead. Confirm the access-removal workflow, the responsible administrator, escalation arrangements and the records needed to demonstrate completion.
Implement the approved change
Owner: the designated access administrator and relevant process stakeholders. Add the completion check, communicate responsibilities and handle current exceptions through the organization's authorized process.
Validate and close
Owner: the person assigned to verify remediation. Review the agreed evidence and follow-up sample. Close the action only when the agreed criteria are met; otherwise record the remaining gap and next step.
Applying this structure to your facility
A Phantom PenTest Access Control Assessment can examine how permissions and entry procedures work together. A Security Program Assessment addresses policy, roles, training and operating practice. Systems or controlled testing may be included through the relevant separately agreed service.
Use this sample to discuss the level of evidence, leadership explanation and follow-up planning your organization needs. Read the assessment preparation guide to plan the scope and information-sharing arrangements.