There are best practices for everything in business, software coding, sales management, and human resources, just to mention a few. IT monthly management reporting is a best practice with the purpose of keeping executives and owners informed regarding the health of their business’ information technology (IT) network.  A report will let you know what is working and what isn’t, what needs your immediate attention and those things that can be taken care of “down the proverbial road.”  A significant feature of IT monthly management reporting is the security aspect of your IT system.

Certainly, as a business owner or executive you are flooded with reams of data and business intelligence, such as sales numbers, inventory information, financial reports, facility records and so on. However, it would be an oversimplification to say you only care if your network is secure. After all, what does “secure” really mean?

Everyone has their own definition of “secure.”  It is a difficult thing to quantify, but you really do want to know if your business environment is safe from all risks. Security is not a state of compliance.  It’s not a condition of being happy with a certain level of perceived safety. Nor is it the knowledge that no known intrusions have taken place. Many organizations end up getting themselves into trouble by being content with this last bit of information. It’s no secret that organizations are failing at early vulnerability and breach detection. In fact, according to a Data Breach Investigations Report, over 92% of breaches go unnoticed by the target organization.

The science of security originates in the tools that quantify security events: number of breaches and viruses, what was blocked, what got through, the damage caused, and the staff hours and resources used to support security.  Effective IT reporting is the art of interpreting this raw data into forms that educate and influence decisions, translating the information from “geek-speak” into what you need to make informed decisions regarding the security of your business’ IT structure.

Every business has different cultures, operations and expectations. Regardless of these differences, organizing your IT reports, especially the security aspect of the information, into easily understandable intelligence, will go a long way in informing, educating and influencing your decisions. By tracking the changes in the monthly reports you can see the progress made in remediating problems affecting your overall security environment. In addition, rather than just conveying information, the statistics and trends the reports contain allow you to make necessary adjustments in your business’ policies and procedures that have to do with your IT communications, user information and other aspects of IT security.

An IT monthly report will include information regarding the day-to-day services that maintain your organization’s security stance and lessen or lower risk. What does that include?

• Controlling access to systems through such things as remote access tokens or keys
• Maintaining firewall rules
• Responses to external threats such as viruses, worms, ransomware, and other maleware
• Recovering from security incidents
• Rehabilitating compromised equipment
• Discovering and Preventing vulnerabilities

Each report should contain two types of information, assessment and activities. The assessment aspect should answer your main concern, “Are we secure?” It should be short and simple, and essentially coded into area such as: “problems,” “concerns” and “satisfactory.” It should answer questions like: “Do we need additional employee training and quality assurance?” A goal of the assessment report is to highlight items that need your attention.

The activity aspect contains details regarding the assessment. How many intrusion attempts were deflected? If a threat gained access, what was the cost of recovering from system compromises? This aspect should contain information regarding routine tasks such as password resets, and access token issues. It is here that your IT MSP should provide you with tangible evidence that your investment in their services is of value to your business.

Contact us, we don’t just monitor your system, we manage every aspect and provide you comprehensive information about the health of your network on a monthly basis.