This page is written for management. Part 2 further down is for the person who runs IT. 1 of 26 questions in the questionnaire are unanswered. The report covers the technical side; when you answer, the rest is filled in.
Baseline protection is missing
As the environment stands today, one stolen account or one successful phishing email can give an attacker what they need. The good news is that the most important measures are quick and often free. Start with the three at the top of the page.
An adviser at Enora has quality-assured the whole report before delivery, and reviewed the recommendations and the findings that need professional assessment in detail.
This is where you stand
Example has got some of the most important things right: all administrators have MFA, the audit log is switched on, and the licence (Business Premium) includes most of the protection you need. That is a good starting point, because most of the measures in this report are about switching on what you already have, not buying something new.
What needs attention is two issues. One administrator account has a password in circulation from a known leak, and Remote Desktop is open to the internet on one of your addresses. Each on its own is a common cause of ransomware among Norwegian SMEs. Together they give an attacker both the key and the door. Right after that comes backup: today there is no copy of email and documents outside Microsoft's own Recycle Bin, so a successful attack would also mean permanent loss.
If this is left as it is, the question is not whether you will be attacked, but when an attempt succeeds. The three measures at the top take one working day together and cost little. After that you are in a very different position, and the rest of the report can be worked through at a steady pace.