This invented small team uses Microsoft 365, Exchange Online, and Windows. It has a security owner, an incomplete inventory, no MFA, partially managed updates, and questions it still needs to investigate.
The example uses the same rules as the free checkup. It is not a customer case study, evidence of effectiveness, or a recommendation for your organization.
Use available capabilities; document cost or licensing constraints rather than assuming a paid product.
Selected NIST category alignment, not complete category coverage. Linked SCuBA baselines are version-pinned supporting references, not an automated assessment or a universal SMB mandate.
Use available capabilities; document cost or licensing constraints rather than assuming a paid product.
Selected NIST category alignment, not complete category coverage. Linked SCuBA baselines are version-pinned supporting references, not an automated assessment or a universal SMB mandate.
Use available capabilities; document cost or licensing constraints rather than assuming a paid product.
Selected NIST category alignment, not complete category coverage. Linked SCuBA baselines are version-pinned supporting references, not an automated assessment or a universal SMB mandate.
Microsoft licensing and permissions affect available settings and evidence; missing capability is not a pass.
Selected NIST category alignment, not complete category coverage. Linked SCuBA baselines are version-pinned supporting references, not an automated assessment or a universal SMB mandate.
Use available capabilities; document cost or licensing constraints rather than assuming a paid product.
Selected NIST category alignment, not complete category coverage. Linked SCuBA baselines are version-pinned supporting references, not an automated assessment or a universal SMB mandate.
Microsoft licensing and permissions affect available settings and evidence; missing capability is not a pass.
Selected NIST category alignment, not complete category coverage. Linked SCuBA baselines are version-pinned supporting references, not an automated assessment or a universal SMB mandate.
Microsoft licensing and permissions affect available settings and evidence; missing capability is not a pass.
Selected NIST category alignment, not complete category coverage. Linked SCuBA baselines are version-pinned supporting references, not an automated assessment or a universal SMB mandate.
Use available capabilities; document cost or licensing constraints rather than assuming a paid product.
Selected NIST category alignment, not complete category coverage. Linked SCuBA baselines are version-pinned supporting references, not an automated assessment or a universal SMB mandate.
Use available capabilities; document cost or licensing constraints rather than assuming a paid product.
Selected NIST category alignment, not complete category coverage. Linked SCuBA baselines are version-pinned supporting references, not an automated assessment or a universal SMB mandate.
Use available capabilities; document cost or licensing constraints rather than assuming a paid product.
Selected NIST category alignment, not complete category coverage. Linked SCuBA baselines are version-pinned supporting references, not an automated assessment or a universal SMB mandate.
Microsoft licensing and permissions affect available settings and evidence; missing capability is not a pass.
Selected NIST category alignment, not complete category coverage. Linked SCuBA baselines are version-pinned supporting references, not an automated assessment or a universal SMB mandate.
Use available capabilities; document cost or licensing constraints rather than assuming a paid product.
Selected NIST category alignment, not complete category coverage. Linked SCuBA baselines are version-pinned supporting references, not an automated assessment or a universal SMB mandate.
Use available capabilities; document cost or licensing constraints rather than assuming a paid product.
Selected NIST category alignment, not complete category coverage. Linked SCuBA baselines are version-pinned supporting references, not an automated assessment or a universal SMB mandate.
Use available capabilities; document cost or licensing constraints rather than assuming a paid product.
Selected NIST category alignment, not complete category coverage. Linked SCuBA baselines are version-pinned supporting references, not an automated assessment or a universal SMB mandate.
Missing foundational protections are Act first; partial or other gaps are Plan next. Unknown answers or uncertain applicability need verification. Priorities are guidance, not calculated risk or business-impact estimates.
Self-reported answers; no independent evidence has been collected or verified. A starting point for improvement, not certification or a complete risk assessment. NIST category mappings are authored alignment, not an official crosswalk. Check licensing and test changes safely before applying them.
Catalog 0.2.1 · Content review: 2026-09-22 · Created