Prepare a provider escalation and evidence pack

01Make the request answerable

A screenshot of a score often leaves a provider with too little information to act. Assemble the observation, affected service and question together. Share only information necessary for the recipient; API keys, passwords and recovery codes have no place in the evidence pack.

02Implementation checklist

1. Identify the exact domain or asset, scan date, mode and report reference. State whether the scan completed and which checks were unavailable.
2. Quote the observed condition in your own summary and attach the relevant evidence. Distinguish an inferred risk from a verified configuration or vulnerability.
3. Explain the business service involved and ask which party is responsible for the component. Include the support contract or service reference where useful.
4. Request specific confirmation: for example the deployed package release and advisory, the configured email sender, or the header change and pages tested.
5. Agree an owner, response date and escalation route. Where a change needs approval or has a service impact, record the proposed action and decision.
6. Close the item with a dated response and appropriate retest. Preserve unresolved limitations and any accepted exception with a named review date.

03If the pack supports an insurance conversation

The NCSC’s cyber-insurance guidance explains that insurers may ask about technical, procedural and human controls, and that providers may help supply this information. Answer the actual questions using current evidence and involve your broker or insurer where the meaning is unclear.

A CyberScan report is one piece of evidence. It does not certify compliance or guarantee cover, renewal, a premium or a claim outcome. Keep the report’s scope visible alongside any wider account-security, backup or incident-response evidence.