Reporting & audit packs
Give leadership, auditors, and insurance reviewers a clear account of your security position: control condition, unresolved work, risk, and the evidence behind it.
Choose the report purpose and scope. Save the evidence as it stood at that time, including known gaps. Export the same record whenever you need it.
Sample report contents
01 / 04 · Security and GRC
Authorized scope · Evidence-as-of time
Control state, exposure, and evidence freshness
Open remediation and documented exceptions
Approved actions and the evidence from retesting
Source records and the time each state was observed
02 / 04 · Executives
Authorized scope · Evidence-as-of time
Modeled risk and the available history behind it
Important exposure and unresolved work
Remediation and the observed result
The evidence behind the executive summary
03 / 04 · Audit and compliance
Authorized scope · Evidence-as-of time
Required conditions and observed control state
Documented exceptions and remediation history
Evidence provenance and observation timestamps
Supporting records kept with the audit package
04 / 04 · Insurance
Authorized scope · Evidence-as-of time
Current evidence for renewal and underwriting questions
Evidence packages for authorized market review
Control condition and relevant changes over time
Source-linked evidence and historical proof
Illustrative contents, not customer data. Each report records its scope, the time its evidence was captured, and any known gaps.
Export formats
Use PDF for review, Excel or CSV for analysis, JSON for structured data, or a ZIP evidence package to keep the report and its manifest together.
Share a saved report with leadership, auditors, or insurance reviewers. Its scope, supporting evidence, and known gaps stay with the record.
Export the report data for spreadsheet analysis or downstream processing. Exports use the saved record, so later downloads do not silently replace it with newer evidence.
Download a package containing the report record and its evidence manifest: the sources, capture times, and integrity information behind the report.
Report options
Create an organization-wide report or focus on a completed incident. Available purposes include executive and board review, underwriting and renewal, broker submissions, audit and compliance, claims, M&A diligence, portfolio review, post-incident review, and remediation closure.
These are purpose-based reports, not a drag-and-drop report designer. For a custom layout or a specific set of fields, discuss the requirements with PatientLock.
Filter saved reports by audience, organization or incident scope, and whether they contain known gaps. Narrow the list to reports created in the last 30 or 90 days, or search the report details.
These filters help you find saved records; they do not change the evidence or reporting period inside an existing report.
Compliance frameworks
NIST CSF 2.0 is part of the current framework data. Reporting also serves leadership, insurance, incident review, and diligence needs that are not tied to a single compliance framework.
Bring the framework and review scope to PatientLock so we can confirm the available control mappings, supporting evidence, and any coverage gaps. These are not currently selectable framework-specific templates in the report builder.
Discuss your framework requirementsFrom source to report
Keep the scope, current condition, validated changes, and supporting proof together. Authorized reviewers can see what the report covers and the evidence behind its conclusions.
Who the report serves and what it covers
Controls, exposure, exceptions, and evidence quality
What changed and what the environment showed afterward
Source-linked evidence and integrity information
Reporting center
Tell us who will read the report, what it needs to cover, and which framework or review requirements apply.
