Security outcomes

A reported result needs a boundary, a source, and an owner.

Yojo's reporting standard separates what was observed, what was approved, what changed, and what was checked afterwards.

Yojo reporting standard

Make every statement inspectable.

A reader should be able to identify the system, starting condition, source, accountable owner, review period, action, and latest validation state without relying on an unsupported headline number.

Reporting anatomy

One complete outcome record.

This is the record structure Yojo proposes for an engagement. The values are agreed for the work; no client result is represented here.
Scope
Systems, assets, assumptions, and exclusions recorded for the engagement.
Baseline
Starting condition and measurement method agreed before work begins.
Source
Named assessment record, control check, telemetry source, or incident record.
Owner
Person accountable for the decision, with a separate action owner where needed.
Review period
Dates during which the condition, action, and latest check are assessed.
Finding
Observed condition, affected service, and relevance to the agreed decision.
Action
Approved change, dependencies, action owner, and due date.
Validation state
Not checked, partly checked, or checked against the agreed acceptance criteria.

Reporting discipline

A finding becomes a result only after the state is recorded.

These checks keep assessment reports, findings registers, action records, and validation notes distinct.
  1. 01

    Define what changed.

    Separate an observed finding, an approved action, a completed change, and a checked result. They are not the same reporting state.

  2. 02

    Name the measurement boundary.

    Record the included systems, starting condition, review period, method, and assumptions before comparing results.

  3. 03

    Keep the source traceable.

    Link each statement to a named assessment record, control check, telemetry source, incident record, or other agreed source.

  4. 04

    Record ownership and validation.

    Name the decision owner, action owner, due date, acceptance criteria, and date of the latest check.

Records that support a decision

Findings, actions, validation, and handover remain connected.

Assessment report with an agreed boundary and named sourcesFindings register with decision and action ownersValidation note with acceptance criteria and check dateHandover record with open actions, dependencies, and next review point

Current evidence

Aggregate figures are not published until comparable records exist.

Results from different systems, periods, methods, and engagement boundaries are not combined into a marketing figure. Ask Yojo what records are available today and how each result was counted. Any future figure will include its period, source, and verification date.

Define how the work will be measured before it starts.

Agree outcome measures