Remediation Roadmap, Secure Score and Stakeholder Reporting

Lab Metadata

Core technologies

Scenario and Description

You have spent eleven labs assessing and hardening Northgate's identity estate. But a hardening programme that cannot explain itself to the people who fund it does not get funded again. The final, and often decisive, skill of the specialist role is translation: turning a mass of technical change into a prioritised plan, a tracked metric, and a clear story for the board. The brief lists these as deliverables in their own right, remediation plans, progress reporting, and a long-term identity security roadmap.

Microsoft Secure Score, and its identity component in particular, gives you the single tracked number leadership understands. It scores your tenant against Microsoft's recommended controls and lists the improvement actions still open, many of which map directly to the work you have already done. Around that number you build a prioritised remediation plan (what is left, ordered by risk against effort), a three-horizon roadmap, and a board report that shows the before and after.

You will read Secure Score and its identity controls from Graph, build the prioritised remediation plan and roadmap, generate an executive report, and finish by tracing every line of the brief's "what you will deliver" section back to the labs that delivered it. That traceability is the proof that the programme did what it set out to do.

Prerequisites

Prior labs

The whole track (Labs 01 to 11). This lab consolidates their outcomes. The Lab 11 reporting module provides the metrics, and Secure Score provides the executive number that frames them.

Graph scope introduced

Real-World Problem Statement

Technical teams and boards speak different languages. An engineer says "we enforced phishing-resistant MFA on privileged roles"; a board hears nothing actionable. A board asks "are we safer, by how much, and what is left"; an engineer without a reporting discipline cannot answer crisply. The remediation plan, the score and the roadmap are the shared language that closes that gap and keeps the programme resourced.

Concrete scenario: Northgate's CISO must present quarterly to the board. They need one slide with the identity score trend, a short list of what was fixed, and a costed plan for the next quarter, all traceable back to evidence. Your job is to produce that pack and the tooling that regenerates it.

Skills Mapped to Production Solutions

Reporting Overview

Findings from the whole track flow into three outputs. Secure Score gives the tracked number, the prioritisation matrix orders what remains, and the roadmap phases the work. All three roll up into one board report.

Step-by-Step Implementation

Phase A - Read Secure Score and its identity controls

Connect-MgGraph -Scopes 'SecurityEvents.Read.All','Directory.Read.All' -NoWelcome

# Latest overall Secure Score.
$score = Get-MgSecuritySecureScore -Top 1
$pct = [math]::Round(($score.CurrentScore / [math]::Max($score.MaxScore,1)) * 100)
"Secure Score: {0} / {1}  ({2}%)" -f $score.CurrentScore, $score.MaxScore, $pct

# Control catalogue, filtered to Identity, with remediation and effort.
$profiles = Get-MgSecuritySecureScoreControlProfile -All |
  Where-Object { $_.ControlCategory -eq 'Identity' }

# Your per-control scores from the latest snapshot.
$mine = $score.ControlScores | Where-Object { $_.ControlCategory -eq 'Identity' }

# Join: open identity actions (where your score is below the control max).
$open = foreach ($p in $profiles) {
  $s = $mine | Where-Object { $_.ControlName -eq $p.Id }
  $current = if ($s) { [double]$s.Score } else { 0 }
  if ($current -lt [double]$p.MaxScore) {
    [pscustomobject]@{
      Control       = $p.Title
      Current       = $current
      Max           = $p.MaxScore
      UserImpact    = $p.UserImpact
      Effort        = $p.ImplementationCost
      Remediation   = $p.Remediation
    }
  }
}
$open | Sort-Object Max -Descending | Format-Table Control,Current,Max,Effort -AutoSize

Phase B - Build the prioritised remediation plan

# Score each open item on risk reduction (proxy: control Max points and
# exposure) against effort (ImplementationCost / UserImpact). Then bucket:
#
#   QUICK WINS   : high risk reduction, low effort  -> do first
#   FOUNDATIONAL : high risk reduction, higher effort -> plan and resource
#   FILL-INS     : low risk reduction, low effort    -> batch opportunistically
#   DEFER        : low risk reduction, high effort    -> revisit later

$plan = foreach ($o in $open) {
  $effortRank = switch ($o.Effort) { 'Low' {1} 'Moderate' {2} 'High' {3} default {2} }
  $bucket = if ($o.Max -ge 8 -and $effortRank -le 1) { 'Quick win' }
            elseif ($o.Max -ge 8)                    { 'Foundational' }
            elseif ($effortRank -le 1)               { 'Fill-in' }
            else                                     { 'Defer' }
  [pscustomobject]@{ Control=$o.Control; Points=$o.Max; Effort=$o.Effort; Bucket=$bucket; Action=$o.Remediation }
}
$plan | Sort-Object @{e='Bucket'},@{e='Points';Descending=$true} | Format-Table Control,Points,Effort,Bucket -AutoSize
$plan | Export-Csv "remediation-plan-$(Get-Date -f yyyyMMdd).csv" -NoTypeInformation

Phase C - Construct the identity security roadmap

Phase D - Produce the board report

# Add to the IdentityBytes.EntraSec module from Lab 11.
function New-IBExecutiveReport {
  [CmdletBinding()] param([string]$OutputPath = ".\IB-Board-Report-$(Get-Date -f yyyyMMdd).html")

  $base  = Get-IBIdentityBaseline
  $score = Get-MgSecuritySecureScore -Top 1
  $pct   = [math]::Round(($score.CurrentScore / [math]::Max($score.MaxScore,1)) * 100)

  # Structure (keep it to one page):
  #  1. Headline metric: Secure Score % and direction of travel
  #  2. Three KPIs: MFA-capable %, privileged holders, dormant accounts
  #  3. What we fixed this period (bullet list from closed plan items)
  #  4. What is next (top 3 roadmap items with target dates)
  #  5. Appendix link to the full technical report (Lab 11)

  $summary = [ordered]@{
    'Identity Secure Score' = "$pct%"
    'MFA-capable'           = "$($base.MfaCapablePct)%"
    'Privileged holders'    = (@(Get-IBPrivilegedReport)).Count
    'Dormant accounts'      = $base.Dormant
  }
  # ... render these into the branded one-page HTML (white body, dark hero) ...
  $summary.GetEnumerator() | ForEach-Object { '{0}: {1}' -f $_.Key,$_.Value }
}

Phase E - Trace deliverables to the brief

Testing and Validation

1. Score read: confirm Secure Score returns a current score, max and percentage.
2. Open actions: confirm the identity control list shows remediation, effort and points.
3. Plan: confirm the prioritisation buckets each open item and exports a CSV.
4. Roadmap: confirm each horizon maps to specific labs with owners and dates.
5. Board report: confirm the executive report leads with the metric and fits on a page.

Analysis: keeping the reporting honest

What makes this sound

• Outcome-led: reports lead with risk removed and score moved, not a list of tasks done.
• Prioritised by risk: the plan closes the biggest exposures first, not the easiest.
• Traceable: every deliverable maps to evidence, which is what audit and assurance require.

Watch for vanity metrics

• Secure Score is a useful proxy, not the goal. Do not chase points on low-value controls while a real risk sits open, use the score to communicate, not to steer blindly.
• A rising score with a static roadmap can hide stalled work, always report the score and the plan together.
• Report what is still open honestly. A board trusts a programme that names its gaps far more than one that only reports wins.

Production hardening

• Snapshot the score monthly to build a trend line, one point in time tells no story.
• Tie roadmap items to owners and dates, and review them against the score every quarter.
• Protect the reports themselves, they are a map of your weakest points.

Cleanup Instructions

Remove-Item ".\remediation-plan-*.csv",".\IB-Board-Report-*.html" -ErrorAction SilentlyContinue
Disconnect-MgGraph

Recommended Learning Links

• Microsoft Secure Score
• Identity Secure Score
• Graph API: secureScore and control profiles
• Zero Trust guidance
• Entra architecture resources for reporting visuals

Key Takeaways and Track Complete

• Reporting is a deliverable, not an afterthought, it keeps the programme funded and moving.
• Secure Score gives leadership one trusted number, use it to communicate, not to steer blindly.
• Prioritise remediation by risk against effort, and phase it into a horizon-based roadmap with owners and dates.
• Trace every promised deliverable to evidence, that traceability is your programme assurance.