Security Consultancy Engagement Desk
Cybersecurity consultancies and assessment firms
Clients, security assessments, findings, fixes and retests for a consultancy.
Use this templateSecurity Consultancy Engagement Desk
Every engagement from scoping to retest, plus the findings and reports behind it. Start with the Dashboard each Monday. Written authorization must be on file before any testing starts; check it on the engagement before pressing Start testing. Keep evidence and client secrets out of these rows.
Dashboard
Engagement lifecycle
Writing a finding
Remediation and retest
Clients
Organizations the firm advises, with their contacts and the next scheduled review.
| Client | Status | Sector | Phone | Next client review | Client manager | |
|---|---|---|---|---|---|---|
| Cobalt Valley Clinics | Active | ciso@cobaltvalley.net | (571) 555-0141 | Oct 29, 2026 | Leilani Pruitt | |
| Marlow Savings Co-op | Active | it@marlowsavings.net | (571) 555-0142 | Oct 19, 2026 | Leilani Pruitt | |
| Eastgate School District | Prospect | tech@eastgateschools.net | (571) 555-0143 | Oct 23, 2026 | Leilani Pruitt | |
| Pinewood Retail Group | Active | security@pinewoodretail.net | (571) 555-0144 | Nov 8, 2026 | Leilani Pruitt | |
| Halcyon Plastics | Between engagements | itlead@halcyonplastics.net | (571) 555-0145 | Dec 3, 2026 | Leilani Pruitt | |
| Riverton County Offices | Past client | cio@rivertoncounty.net | (571) 555-0146 | — | Leilani Pruitt | |
| Beacon Pharmacy Network | Prospect | compliance@beaconpharmacy.net | (571) 555-0147 | Oct 17, 2026 | Leilani Pruitt |
Engagements
Each paid piece of work, from scoping to a delivered report and retest.
| Engagement | Client | Kind | Status | Testing starts | Report due | Delivered on |
|---|---|---|---|---|---|---|
| Patient portal assessment | Cobalt Valley Clinics | Testing | Oct 15, 2026 | Oct 19, 2026 | — | |
| Branch network review | Marlow Savings Co-op | Reporting | Oct 1, 2026 | Oct 17, 2026 | — | |
| Staff phishing exercise | Eastgate School District | Scoping | Nov 2, 2026 | Nov 23, 2026 | — | |
| Cloud configuration review | Pinewood Retail Group | Scheduled | Oct 22, 2026 | Nov 8, 2026 | — | |
| Security policy rewrite | Marlow Savings Co-op | Delivered | Sep 9, 2026 | Oct 7, 2026 | Oct 5, 2026 | |
| Ransomware tabletop | Cobalt Valley Clinics | Scheduled | Oct 21, 2026 | Oct 25, 2026 | — | |
| Warehouse network review | Halcyon Plastics | Retest | Aug 20, 2026 | Sep 19, 2026 | Sep 21, 2026 | |
| County website assessment | Riverton County Offices | Closed | Apr 2, 2026 | May 2, 2026 | Apr 30, 2026 |
Findings
Each issue found, how serious it is, who must fix it and by when.
| Finding | Engagement | Severity | Status | Fix by | Fixed on | Client owner |
|---|---|---|---|---|---|---|
| Admin pages reachable without extra sign-in | Patient portal assessment | Open | Oct 26, 2026 | — | Portal team lead | |
| Old software version on the booking server | Patient portal assessment | Fix in progress | Nov 2, 2026 | — | Infrastructure lead | |
| Shared account used by two staff | Branch network review | Open | Oct 16, 2026 | — | Branch IT | |
| Firewall rule allows wide access | Branch network review | Fix in progress | Oct 19, 2026 | — | Branch IT | |
| Backups not tested | Branch network review | Open | Nov 8, 2026 | — | Operations | |
| Password policy too short | Security policy rewrite | Retest needed | Oct 9, 2026 | — | IT manager | |
| Unused open ports on the file server | Warehouse network review | Retest needed | Oct 21, 2026 | — | IT manager | |
| Staff training records incomplete | Security policy rewrite | Accepted risk | Dec 18, 2026 | — | HR |
Deliverables
The reports, summaries and briefings the client is owed for each engagement.
| Deliverable | Engagement | Kind | Status | Due on | Sent on | Editor |
|---|---|---|---|---|---|---|
| Patient portal technical report | Patient portal assessment | Not started | Oct 19, 2026 | — | Caspian Moreau | |
| Patient portal executive summary | Patient portal assessment | Not started | Oct 20, 2026 | — | Caspian Moreau | |
| Branch network technical report | Branch network review | In review | Oct 19, 2026 | — | Caspian Moreau | |
| Branch network readout meeting | Branch network review | Not started | Oct 22, 2026 | — | Ramona Achterberg-Singh | |
| Cloud review kickoff summary | Cloud configuration review | Not started | Oct 23, 2026 | — | Caspian Moreau | |
| Warehouse retest letter | Warehouse network review | Drafting | Oct 17, 2026 | — | Caspian Moreau | |
| Policy rewrite remediation plan | Security policy rewrite | Sent | Oct 7, 2026 | Oct 8, 2026 | Caspian Moreau |
Delivery at a glance. Charts read the live tables.
| Engagement | Client | Kind | Status | Testing starts | Report due | Delivered on |
|---|---|---|---|---|---|---|
| Patient portal assessment | Cobalt Valley Clinics | Testing | Oct 15, 2026 | Oct 19, 2026 | — | |
| Branch network review | Marlow Savings Co-op | Reporting | Oct 1, 2026 | Oct 17, 2026 | — | |
| Staff phishing exercise | Eastgate School District | Scoping | Nov 2, 2026 | Nov 23, 2026 | — | |
| Cloud configuration review | Pinewood Retail Group | Scheduled | Oct 22, 2026 | Nov 8, 2026 | — | |
| Security policy rewrite | Marlow Savings Co-op | Delivered | Sep 9, 2026 | Oct 7, 2026 | Oct 5, 2026 | |
| Ransomware tabletop | Cobalt Valley Clinics | Scheduled | Oct 21, 2026 | Oct 25, 2026 | — | |
| Warehouse network review | Halcyon Plastics | Retest | Aug 20, 2026 | Sep 19, 2026 | Sep 21, 2026 | |
| County website assessment | Riverton County Offices | Closed | Apr 2, 2026 | May 2, 2026 | Apr 30, 2026 |
| Finding | Engagement | Severity | Status | Fix by | Fixed on | Client owner |
|---|---|---|---|---|---|---|
| Admin pages reachable without extra sign-in | Patient portal assessment | Open | Oct 26, 2026 | — | Portal team lead | |
| Old software version on the booking server | Patient portal assessment | Fix in progress | Nov 2, 2026 | — | Infrastructure lead | |
| Shared account used by two staff | Branch network review | Open | Oct 16, 2026 | — | Branch IT | |
| Firewall rule allows wide access | Branch network review | Fix in progress | Oct 19, 2026 | — | Branch IT | |
| Backups not tested | Branch network review | Open | Nov 8, 2026 | — | Operations | |
| Password policy too short | Security policy rewrite | Retest needed | Oct 9, 2026 | — | IT manager | |
| Unused open ports on the file server | Warehouse network review | Retest needed | Oct 21, 2026 | — | IT manager | |
| Staff training records incomplete | Security policy rewrite | Accepted risk | Dec 18, 2026 | — | HR |
| Finding | Engagement | Severity | Status | Fix by | Fixed on | Client owner |
|---|---|---|---|---|---|---|
| Admin pages reachable without extra sign-in | Patient portal assessment | Open | Oct 26, 2026 | — | Portal team lead | |
| Old software version on the booking server | Patient portal assessment | Fix in progress | Nov 2, 2026 | — | Infrastructure lead | |
| Shared account used by two staff | Branch network review | Open | Oct 16, 2026 | — | Branch IT | |
| Firewall rule allows wide access | Branch network review | Fix in progress | Oct 19, 2026 | — | Branch IT | |
| Backups not tested | Branch network review | Open | Nov 8, 2026 | — | Operations | |
| Password policy too short | Security policy rewrite | Retest needed | Oct 9, 2026 | — | IT manager | |
| Unused open ports on the file server | Warehouse network review | Retest needed | Oct 21, 2026 | — | IT manager | |
| Staff training records incomplete | Security policy rewrite | Accepted risk | Dec 18, 2026 | — | HR |
| Engagement | Client | Kind | Status | Testing starts | Report due | Delivered on |
|---|---|---|---|---|---|---|
| Patient portal assessment | Cobalt Valley Clinics | Testing | Oct 15, 2026 | Oct 19, 2026 | — | |
| Branch network review | Marlow Savings Co-op | Reporting | Oct 1, 2026 | Oct 17, 2026 | — | |
| Staff phishing exercise | Eastgate School District | Scoping | Nov 2, 2026 | Nov 23, 2026 | — | |
| Cloud configuration review | Pinewood Retail Group | Scheduled | Oct 22, 2026 | Nov 8, 2026 | — | |
| Security policy rewrite | Marlow Savings Co-op | Delivered | Sep 9, 2026 | Oct 7, 2026 | Oct 5, 2026 | |
| Ransomware tabletop | Cobalt Valley Clinics | Scheduled | Oct 21, 2026 | Oct 25, 2026 | — | |
| Warehouse network review | Halcyon Plastics | Retest | Aug 20, 2026 | Sep 19, 2026 | Sep 21, 2026 | |
| County website assessment | Riverton County Offices | Closed | Apr 2, 2026 | May 2, 2026 | Apr 30, 2026 |
Findings overdue for a fix
| Finding | Engagement | Severity | Status | Fix by | Fixed on | Client owner |
|---|---|---|---|---|---|---|
| Admin pages reachable without extra sign-in | Patient portal assessment | Open | Oct 26, 2026 | — | Portal team lead | |
| Old software version on the booking server | Patient portal assessment | Fix in progress | Nov 2, 2026 | — | Infrastructure lead | |
| Shared account used by two staff | Branch network review | Open | Oct 16, 2026 | — | Branch IT | |
| Firewall rule allows wide access | Branch network review | Fix in progress | Oct 19, 2026 | — | Branch IT | |
| Backups not tested | Branch network review | Open | Nov 8, 2026 | — | Operations | |
| Password policy too short | Security policy rewrite | Retest needed | Oct 9, 2026 | — | IT manager | |
| Unused open ports on the file server | Warehouse network review | Retest needed | Oct 21, 2026 | — | IT manager | |
| Staff training records incomplete | Security policy rewrite | Accepted risk | Dec 18, 2026 | — | HR |
Deliverables due in the next 7 days
| Deliverable | Engagement | Kind | Status | Due on | Sent on | Editor |
|---|---|---|---|---|---|---|
| Patient portal technical report | Patient portal assessment | Not started | Oct 19, 2026 | — | Caspian Moreau | |
| Patient portal executive summary | Patient portal assessment | Not started | Oct 20, 2026 | — | Caspian Moreau | |
| Branch network technical report | Branch network review | In review | Oct 19, 2026 | — | Caspian Moreau | |
| Branch network readout meeting | Branch network review | Not started | Oct 22, 2026 | — | Ramona Achterberg-Singh | |
| Cloud review kickoff summary | Cloud configuration review | Not started | Oct 23, 2026 | — | Caspian Moreau | |
| Warehouse retest letter | Warehouse network review | Drafting | Oct 17, 2026 | — | Caspian Moreau | |
| Policy rewrite remediation plan | Security policy rewrite | Sent | Oct 7, 2026 | Oct 8, 2026 | Caspian Moreau |
Reports due this week
| Engagement | Client | Kind | Status | Testing starts | Report due | Delivered on |
|---|---|---|---|---|---|---|
| Patient portal assessment | Cobalt Valley Clinics | Testing | Oct 15, 2026 | Oct 19, 2026 | — | |
| Branch network review | Marlow Savings Co-op | Reporting | Oct 1, 2026 | Oct 17, 2026 | — | |
| Staff phishing exercise | Eastgate School District | Scoping | Nov 2, 2026 | Nov 23, 2026 | — | |
| Cloud configuration review | Pinewood Retail Group | Scheduled | Oct 22, 2026 | Nov 8, 2026 | — | |
| Security policy rewrite | Marlow Savings Co-op | Delivered | Sep 9, 2026 | Oct 7, 2026 | Oct 5, 2026 | |
| Ransomware tabletop | Cobalt Valley Clinics | Scheduled | Oct 21, 2026 | Oct 25, 2026 | — | |
| Warehouse network review | Halcyon Plastics | Retest | Aug 20, 2026 | Sep 19, 2026 | Sep 21, 2026 | |
| County website assessment | Riverton County Offices | Closed | Apr 2, 2026 | May 2, 2026 | Apr 30, 2026 |
How to read the numbers
Every engagement follows the same stages. A client who knows the stages trusts the process and the price.
Stages
Never skip
Written authorization from someone who can give it.
An emergency contact for the test window.
A stop word if something unexpected happens.
A finding that is not fixed was not written well enough. Write for the person who has to fix it and the person who pays for it.
Every finding answers four questions
What did we find, in a sentence a manager understands?
Why does it matter to this organization?
What should they do, in the order they should do it?
How will we know it is fixed?
Rating severity
Keep out of the row
Never paste passwords, personal data or exploit detail into a finding row. Point to the evidence store instead.
The report is the start of the client's work, not the end of ours. Retests are where the value is proved.
Within two weeks of delivery
Send the remediation plan with owners and dates.
Add the fix-by date to each finding row.
Schedule a check-in with the sponsor.
When the client says it is fixed
Press Needs retest.
Retest only what the finding described.
Press Mark fixed with the retest date, or reopen it with the new evidence.
What's inside
5 tables · 28 views · 1 form · 12 row actions · 1 agent5 pages
- Security Consultancy Engagement Desk
- Dashboard
- Engagement lifecycle
- Writing a finding
- Remediation and retest
4 tables
- Clients7 views · 7 sample rows
- Engagements7 views · 8 sample rows
- Findings7 views · 10 sample rows
- Deliverables7 views · 7 sample rows
Related workspaces
- App Development Agency StudioClients, app projects, milestones and the bug list for a mobile and web agency.
- SaaS Startup Operating SystemCustomers, roadmap, support tickets and monthly metrics for a software startup.
- Employee DirectoryTeams of any size: find anyone by team, manager, skills and time zone.
- IT Managed Services DeskClients, devices, support tickets, contract renewals and scheduled maintenance for an MSP.
- Performance Review CycleHR and managers: run review rounds with goals, feedback and sign-off.
- Support and Feedback TrackerSmall support teams: triage tickets, track feature requests, link help articles.