This sample report records the result of an evaluation of administrative and personnel security policies and procedures at an organization. The purpose of this report is to illustrate a format that can be used to communicate the status of company policies, and also to present recommendations for policy changes to management, including details of specific policy and procedure findings, gaps and recommendations regarding policy changes, and more that could be incorporated into your own review.

Examples include access control policies, personnel information security considerations, guidelines for hiring/transfer/separation and security awareness training.