BSI C5 · report types

A snapshot, or proof that it kept working

Type 1
A first step
One date
Are the controls designed properly?
What that looks like

You have a written process for removing someone's access when they leave.

Type 2
What buyers want
3 to 12 months
Did they actually work, day after day?
What that looks like

There were 14 leavers in the period, and here is when each one lost access.