After the audit: prioritising remediation and measuring progress

Order by risk, not by ease

It is tempting to start with what is simple. Yet priority should reflect risk: the likelihood that a finding is exploited, combined with the impact if it is. A Global Administrator account without MFA, an attack path leading to Domain Admins or a vulnerable certificate template comes before a convenience setting, even if fixing it takes more effort.

The useful question for each finding: can an attacker who has compromised an ordinary user workstation use it, and what do they gain? Findings that lead directly to control of the directory or the tenant form the first batch, however difficult they are.

Separating quick wins from structural work

Once the risk is established, effort helps organise the schedule. Two categories emerge:

• Quick wins: low cost and high impact, such as creating properly protected emergency access accounts, removing Global Administrators who no longer need the role, blocking legacy authentication, restricting user consent to applications, or removing inactive privileged accounts;
• Structural work: a tiered administration model, PIM rollout, phishing-resistant methods for everyone, an overhaul of Active Directory delegations, clean-up of the certification authority. These need a project, a budget and time.

Quick wins show visible progress within weeks and build momentum; structural work addresses root causes. A good plan runs both in parallel.

Watch out for dependencies between actions. You cannot require a phishing-resistant method before users have registered one, remove standing assignments before PIM is configured and administrators trained, or tighten Active Directory delegations without knowing who uses them. Grouping findings by theme (privileged access, authentication, applications, on-premises directory) helps bring these sequences to light and build coherent work packages, each given to one team. It also avoids tackling the same topic ten times from different angles.

An owner and a deadline for every action

An action without a named owner does not move. Each line of the plan should state a person (not a team), a deadline, any dependencies and the completion criterion: how will we know it is done? For risks the organisation chooses not to address, formal acceptance by an authorised manager, dated and periodically reviewed, is better than silent neglect. An exceptions register stops temporary waivers from becoming permanent.

Measuring progress

Steering relies on a few simple metrics, measured at regular intervals:

1. the number of permanent assignments to privileged roles;
2. the share of users and administrators with a phishing-resistant method;
3. the number of attack paths to privileged Active Directory groups;
4. the number of critical and high findings still open;
5. the trend in Secure Score, to be read with caution since it reflects generic recommendations rather than your actual risk.

These metrics feed a monthly review with the management sponsor, who arbitrates when work is blocked.

Verifying with a follow-up audit

An action reported as complete is not necessarily effective. A targeted follow-up audit a few months later checks that the fixes are in place and have not introduced new problems. It also catches regressions: a corrected setting later changed by a new project, an administrator account recreated outside the process.

What an audit checks

• A risk-ordered action plan stemming from the previous audit.
• A named owner, a deadline and a completion criterion for each action.
• A register of accepted risks and exceptions, with review dates.
• Metrics tracked over time and reported to management.
• The actual state of fixes reported as complete, and the absence of regressions.