Monthly IT health report

Kestrel & Vance LLP: August 2026

Generated Sep 2, 2026 by Retrisa · Read from Microsoft 365

Demo — fictional sample dataNeeds attention

Staff: 32
Accounts: 33
Managed devices: 38 (32 computers, 6 mobile)
Plan: Premium

Accounts are the 32 staff plus Retrisa’s monitored break-glass admin account.

Summary

August was a steady month. Every account is protected with multi-factor authentication, Microsoft 365 ran normally and backups completed every night. A restore test on August 28 brought back a SharePoint folder in 11 minutes, exactly as expected.

Two things are open. Four SharePoint sites still share files with people outside the firm, and we need your approval to limit that to named guests. Separately, the shared front-desk PC has encryption paused after a firmware update; we are resuming it and have confirmed it holds no client files.

Security posture

Microsoft Secure Score71%Good
Similar-sized organizations average 52%.
MFA coverage33 of 33 accounts (100%)Good
Admin accounts2, both with MFAGood
Devices encrypted37 of 38Exception
The exception is RCPT-01, the shared front-desk PC: encryption was paused for a firmware update on Aug 27 and has not resumed yet. It stores no client files. See open issues.
Devices fully up to date36 of 38Good
Two laptops have updates installed and are waiting for a restart (Marcus Webb, Hannah Lee). Reminders sent.
Email spoofing protectionSPF, DKIM and DMARC enforcedGood

Account and access changes

Aug 11New starterNina Patel (Associate): account, mailbox, MFA and laptop access set up before day one.
Aug 15LeaverCarl Dunn (Paralegal): sign-in blocked at 5:00 PM on the last day, mailbox kept for the partners, license reassigned.
Aug 19Cleanup3 unused accounts disabled: an old scanner login, a former vendor portal account and a 2025 intern account.
Aug 21Access changeShared billing mailbox access added for Tomas Silva (Paralegal), approved by Priya Raman.

Devices and patching

Monthly Windows, macOS and application updates were installed across the fleet. 36 of 38 devices are fully up to date and all 32 computers have endpoint protection running.

Exceptions

RCPT-01 (shared front-desk PC)
Encryption paused after a firmware update on Aug 27.
Action: Resume encryption and confirm the recovery key is stored. Retrisa, by Sep 5.
Laptops of Marcus Webb and Hannah Lee
Updates installed, waiting for a restart.
Action: Restart when convenient; enforced automatically on Sep 6 if not.

Backup and recovery testing

In scope for this client: Microsoft 365 mail, OneDrive and SharePoint, backed up nightly and kept for one year. The firm has no on-site servers.

31 of 31 nightly Microsoft 365 backups completed successfully.
Aug 28: a SharePoint folder (212 files) was restored to a test location in 11 minutes and checked against the original. Passed.

Work completed

Monthly updates installed on 36 of 38 devices
New starter set up and leaver removed on the agreed dates
3 unused accounts disabled
Backup restore test completed and verified
Quarterly security review: sign-in policies and admin roles re-checked, no changes needed

Open issues

Medium severity
Files shared outside the firm
What
4 SharePoint sites allow sharing with anyone who has a link.
Owner
Kestrel & Vance (decision: Priya Raman)
Next step
Approve limiting external sharing to named guests; Retrisa applies it the same day.
Due
Decision requested by Sep 12
Medium severity
Encryption paused on RCPT-01
What
Shared front-desk PC; no client files stored locally.
Owner
Retrisa
Next step
Resume encryption and verify the recovery key.
Due
Sep 5
Low severity
Two laptops waiting for a restart
What
Updates are installed and take effect after a restart.
Owner
Marcus Webb, Hannah Lee
Next step
Restart when convenient; enforced automatically on Sep 6.
Due
Sep 6

Decisions needed from you

Limit external file sharing
4 sites currently allow "anyone with the link" sharing.
Our recommendation: Allow sharing only with named guests. Existing client links keep working if the guest is named.

Next month

Resume encryption on RCPT-01 and confirm the recovery key
Apply the external sharing change once approved
New starter on Sep 8: accounts and access ready before day one
September restore test (a mailbox this time)