Attestor
← Back to overviewOverview
Free · no account

The gap assessment

Answer in plain language — honestly, not aspirationally. Out comes a readiness score and a prioritised list of gaps, each mapped to the control Attestor would monitor. Share it with your team before you decide anything.

Section 01 · 6

Identity & access

Who can sign in, and how

Is multi-factor authentication enforced for every user, with no exclusions?

A policy that exists but exempts admins or service accounts does not count.

Do you review who holds privileged (admin) roles at least quarterly?

Global admins, billing admins and anyone who can change security settings.

When someone leaves, is their access removed from every system within one business day?

Including email, files, cloud consoles and third-party apps.

Do you know which external guests have access to your tenant, and why?

Guest and partner accounts in Microsoft 365 / Entra ID.