QBR Dashboard: GCT

Watchlist

3 items to raise in the meeting

Compliance

33% overall compliance rate (19 compliant / 20 partial / 0 non-compliant / 19 unknown of 58 requirements)

▼ 41pts vs Q1 2026

Evidence coverage 72% · Source alignment 60%

Policy Coverage

55% coverage (11 of 20 policies covered: 1 overdue, 2 missing)

▼ 16pts vs Q1 2026

40% of policies are within their review cycle (8 of 20)

Reviewed in Q3 2026 (0)

Risk Posture

7 open risks of 27 total (0 high residual, avg residual score: 4.6)

▲ 1 vs Q1 2026

Reviewed in Q3 2026 (3)

Weak or Shared Passwords

reviewed 06 Jul 2026 by James Holden (IT Manager)

Open

Use of weak, reused, or shared credentials across accounts and systems.

Residual: likelihood 2, impact 3

Treatment: Mitigate

Notes: Controls in place.

Unpatched Operating Systems

reviewed 06 Jul 2026 by James Holden (IT Manager)

In progress

Operating systems running beyond vendor support or missing critical security patches.

Residual: likelihood 2, impact 3

Treatment: Mitigate

Notes: Controls in place.

GDPR / Data Protection Non-Compliance

reviewed 06 Jul 2026 by James Holden (IT Manager)

In progress

Failure to meet UK GDPR obligations: inadequate consent, retention, or subject rights handling.

Residual: likelihood 1, impact 3

Treatment: Mitigate

Notes: Controls in place.

Incident History

1 open of 5 total (2 critical/high severity, 3 closed)

▼ 3 vs Q1 2026

Reported in Q3 2026 (1)

Supply chain software update compromise

reported 19 Jul 2026: Critical severity

Investigating

Legitimate software vendor pushed malicious update to 3 hosts. Detected by EDR before execution.

Category: SupplyChain

QBR Dashboard: Internal Review

Watchlist

Compliance

Policy Coverage

Risk Posture

Incident History