Material incidents
Leaders see the material incidents that affected the business since the last review.
FunctionOne cybersecurity
FunctionOne security reviews for leadership
FunctionOne's security reviews for leadership cover material incidents, response actions, open remediation, repeat findings and systems that aren't sending expected data. Leaders get a monthly summary and a regular security review that name owners and next steps and flag the decisions they need to make. Leadership makes the business and risk calls, and FunctionOne organizes remediation and follow-up. The records also help answer audit and insurance questions.
Book a security assessment
We'll review your systems and accounts, then agree scope and response rules with you before anything is switched on.
We use your details only to arrange your assessment.
What FunctionOne security reviews for leadership include
FunctionOne delivers security reviews for leadership from Syracuse, New York and Tampa, Florida, as part of our managed cybersecurity, and they cover the areas below.
Response actions taken
FunctionOne records the response actions our analysts took. Containment happens only within the response rules your organization approved.
Open remediation work
The review lists remediation work that's still open, with an owner and a next step named for it.
Repeat findings
Findings that come back show up in the review. Your leaders can spot problems that keep returning.
Systems missing data
FunctionOne flags systems that aren't sending the data we expect, so gaps in monitoring stay visible to leadership.
Decisions for leadership
Reports flag the decisions leadership needs to make. Your leaders make the business and risk calls, and FunctionOne organizes remediation and follow-up.
Monthly summary
Leadership gets a monthly summary from FunctionOne alongside the regular security review.
Audit and insurance support
Dashboards, investigation records and reports from FunctionOne help answer audit and insurance questions. On their own, they don't make a company meet its compliance requirements.
Why does board cybersecurity reporting matter to FunctionOne clients?
In The NIST Cybersecurity Framework (CSF) 2.0, published in 2024, NIST describes a two-way flow of information between executives, who set priorities, and managers, who handle specific risks. That same 2024 NIST CSF 2.0 document says results can be shared through risk registers and progress reports.
NIST's 2025 guide, Incident Response Recommendations and Considerations for Cybersecurity Risk Management (SP 800-61 Rev. 3), advises organizations to regularly update senior leadership on the status of major incidents and to follow set media communication procedures. Our reviews cover material incidents and the response actions taken.
CISA's Cross-Sector Cybersecurity Performance Goals 2.0, published in 2025, advises monitoring progress on risk responses through tools such as a plan of action and milestones, risk registers and risk detail reports. Goal 2.B in that 2025 CISA report also calls for recording compensating controls where patching isn't possible. FunctionOne reviews show open remediation and repeat findings, so leadership has records ready when audit and insurance questions come up.
How does a FunctionOne security review for leadership work?
FunctionOne security reviews for leadership follow these steps, starting with a security assessment.
Security assessment
FunctionOne starts with a security assessment. We review your systems and accounts before anything is switched on.
Scope and response rules
FunctionOne agrees scope and response rules with your leadership. Our security analysts take containment steps only within the rules you approve.
Monthly summary
FunctionOne sends leadership a monthly summary. Reports name owners and next steps and flag decisions leadership needs to make.
Regular security review
FunctionOne goes over material incidents, response actions, open remediation and repeat findings with leadership. We also flag systems that aren't sending expected data.
Decisions and follow-up
Your leadership makes the business and risk decisions. FunctionOne organizes remediation and follow-up.
Who decides what in a FunctionOne security review?
Use this split to see which calls stay with your leadership and which work FunctionOne carries out.
| Your leadership | FunctionOne |
|---|---|
| Agrees scope after the security assessment | Reviews systems and accounts before anything is switched on |
| Approves the response rules | Contains threats only within those approved rules |
| Makes the business and risk decisions | Organizes remediation and follow-up |
| Acts on decisions flagged in reports | Names owners and next steps in reports |
| Answers to a board, insurer, auditor or parent company | Supplies dashboards, investigation records and reports that help answer audit and insurance questions |
Who uses FunctionOne security reviews for leadership?
FunctionOne works with established mid-size and large organizations that have outgrown a help desk, from offices in Syracuse, New York and Tampa, Florida.
Owners and executives
You report to a board, insurer, auditor or parent company. FunctionOne gives you a monthly summary and a regular security review with owners, next steps and the decisions you need to make.
IT directors
FunctionOne works fully managed or co-managed beside your in-house IT team. The review shows open remediation and repeat findings, so your team can follow the work.
Leaders of multi-office organizations
FunctionOne runs offices, laptops, phones, servers and cloud from one control point. Our review flags systems that aren't sending expected data.
Teams answering insurers and auditors
FunctionOne dashboards, investigation records and reports help answer audit and insurance questions. They don't by themselves make a company compliant.
What do leaders ask about FunctionOne security reviews?
What does a FunctionOne security review cover?
A FunctionOne security review covers material incidents, response actions, open remediation and repeat findings. It also flags systems that aren't sending expected data. Each report names owners and next steps and points out the decisions your leadership needs to make.
How often does FunctionOne report to leadership?
FunctionOne gives leadership a monthly summary and a regular security review. NIST's Incident Response Recommendations and Considerations for Cybersecurity Risk Management (SP 800-61 Rev. 3), published in 2025, advises organizations to regularly update senior leadership on the status of major incidents.
Does a FunctionOne security review make us compliant?
No. FunctionOne dashboards, investigation records and reports help you answer audit and insurance questions, but they don't by themselves make a company compliant. Your leadership still makes the business and risk decisions, and FunctionOne organizes the remediation and follow-up that come out of them.
How should our board use cybersecurity reporting from FunctionOne?
Your board can use FunctionOne reports to make the decisions those reports flag. In The NIST Cybersecurity Framework (CSF) 2.0 (2024), NIST describes a two-way flow of information between executives, who set priorities, and managers, who handle specific risks, with results shared through risk registers and progress reports.
What happens to open findings after a FunctionOne review?
FunctionOne organizes remediation and follow-up on open findings, and the next review shows open remediation and repeat findings again. CISA's Cross-Sector Cybersecurity Performance Goals 2.0 (2025) advises tracking risk responses through tools such as a plan of action and milestones, risk registers and risk detail reports.
How often should leadership review cybersecurity policies?
CISA's Cross-Sector Cybersecurity Performance Goals 2.0 (2025) says policies for managing the cybersecurity program should be reviewed at least annually and updated when changes are applied. FunctionOne's regular security review gives leadership a recurring look at incidents, open remediation and repeat findings.