Executive Summary
At-a-glance posture for leadership, derived from a single authoritative tenant scan.
This assessment evaluates Northbridge Community Health's SharePoint Online environment against twelve governance and security domains. The estate is mature in adoption: 84 active sites support clinical records, corporate operations and community programmes, with strong backup coverage and endpoint hygiene already in place.
The headline
Northbridge does not have a single catastrophic failure. It has a governance debt — accumulated sharing links, unclassified sensitive content, and stale access — that quietly widens the attack surface. The roadmap in Section 06 closes this debt in four phases over roughly six months, beginning with validation rather than change.
Assessment Overview
Scope, method and the evidence base behind every finding in this report.
Findings are drawn from a single authoritative scan of the production tenant, analysed against vPossible's SharePoint Online control framework. Using one consolidated source — rather than reconciling multiple partial extracts — keeps the evidence trail clean and every figure in this report traceable to the same point in time.
Where figures describe live-tenant state — orphaned accounts, external links, classification coverage — they reflect the scan snapshot and are flagged for validation against the live tenant in Phase 1. This protects against acting on access that may have already been remediated between the scan and report issue.
Domain Maturity & Gap Analysis
Relative maturity across the twelve assessed domains. Longer bars are stronger.
Risk Register
Prioritised risks with likelihood, impact and recommended treatment. Click any row to expand.
| Risk | Domain | Severity | Likelihood | Impact |
|---|
Security Controls Catalogue
Implementation status by control. Filter by domain or status, search, and expand for guidance.
| Control | Domain | Priority | Status |
|---|
Remediation Roadmap
A staged uplift that validates before it changes, sequenced to retire the highest risk first.
Deliverables
What Northbridge receives across the engagement.
Site Explorer
Every reviewed site collection. Search and filter, then click any site to open its full detail.
| Site | Classification | Owners | External sharing | Sensitivity label | Last activity |
|---|
Extract shows 14 representative sites of 84 reviewed. Site names and figures are synthetic for demonstration.
Evidence Explorer
A live extract of reviewed accounts. Search and filter, then click any row for per-user site access.
| Account | Role | Department | MFA | Sites | Last sign-in |
|---|
Extract shows 30 representative accounts of 312 reviewed. Account names and details are synthetic for demonstration.