# Leadership security review

Use a small number of business exposures. Describe evidence with its scope and date. Assign legal or contractual applicability questions to the appropriate advisers.

**Review period / owner:** ____________________

**Attendees and roles (accountable executive, technology lead, compliance, outside adviser if any):** ____________________

**Frameworks or obligations the program claims to follow, and who confirmed applicability:** ____________________

## Obligation crosswalk

One row per commitment the firm has made or must meet. A row with no evidence column filled is a finding.

| Obligation or commitment (regulatory, contractual, investor, insurance) | Policy or procedure that addresses it | Control in operation | Evidence and retention location | Owner | Last confirmed |
| --- | --- | --- | --- | --- | --- |
|  |  |  |  |  |  |
|  |  |  |  |  |  |

## Exposure review

| Business exposure | Control / practice | Evidence, scope, and date | Gap / uncertainty | Accountable owner | Decision required |
| --- | --- | --- | --- | --- | --- |
| Unauthorized access |  |  |  |  |  |
| Loss of important information |  |  |  |  |  |
| Unavailable critical service |  |  |  |  |  |
| Vendor dependency |  |  |  |  |  |
| Delayed detection or response |  |  |  |  |  |
| Payment or instruction fraud |  |  |  |  |  |
| Misuse of AI tools with firm or portfolio data |  |  |  |  |  |

## Measures worth seeing each period

State the measure, the value, its source, and the date. Leave unknown values blank rather than estimating.

| Measure | Value | Source and date | Trend |
| --- | --- | --- | --- |
| Accounts with phishing-resistant or multi-factor sign-in, as a share of all accounts |  |  |  |
| Privileged accounts, and date of last review of that list |  |  |  |
| Devices meeting the baseline (encryption, updates, management), as a share of all devices |  |  |  |
| Critical updates outstanding beyond the agreed window |  |  |  |
| Backup or recovery exercises run, and how many met their objective |  |  |  |
| Vendors handling sensitive data with a review completed in the last year |  |  |  |
| Security awareness or phishing exercise completion and result |  |  |  |
| Incidents and near misses, by category |  |  |  |
| Open findings from the last assessment, penetration test, or audit, by age |  |  |  |

## Changes since the previous review

**Information, services, providers, or access added:** ____________________

**Incidents / exercises / significant findings:** ____________________

**Policy documents due for review or approval this period:** ____________________

**Obligations calendar (regulatory filings, attestations, investor questionnaires, insurance renewal, contract commitments) due in the next two periods:** ____________________

## Exception decision

**Affected service and information:** ____________________

**Consequence / compensating measures:** ____________________

**Remaining exposure:** ____________________

**Accepting owner / review date:** ____________________

## Actions

| Improvement | Owner | Due date | Budget or resource needed | Evidence of completion |
| --- | --- | --- | --- | --- |
|  |  |  |  |  |

## Common failure modes

- The review reads a dashboard nobody can trace to evidence.
- Exceptions accepted in a hurry are never re-examined.
- Vendor reviews are counted as done when the questionnaire was sent, not answered.
- Metrics are reported without the denominator.

A dashboard status should be traceable to evidence. Mark a check as unknown or untested when that is what the record supports.

**Next review date / cadence:** ____________________

This review supports leadership decisions. It does not replace a risk assessment, an independent assessment, or legal advice on which obligations apply.