Annual reports and cyber maturity #

The /annual-reports route turns RiskPilot's audit ledger into a classified, reproducible annual review.

Annual review #

Select a year to see tracked activities, contributors, covered domains, monthly distribution and the detailed ledger. Each entry retains date, domain, action, object and contributor. The displayed methodology states the classification rule.

Maturity radar from 0 to 5 #

Each security service receives a score from 0 to 5 in 0.5 increments or remains unassessed. Every assessed score requires a verifiable rationale. The radar averages assessed domains only and highlights priority weaknesses; it does not turn missing assessments into zero scores.

Immutable snapshots #

Administrators and risk managers can save the assessment and create a snapshot. Each generation adds a retained version: an existing annual snapshot is never rewritten. Versions remain downloadable as JSON or native server-generated PDF.

Recommended use #

Complete rationales before generation, retain evidence in source modules and create a new snapshot after each formal approval. Compare versions instead of replacing a report already presented to management.

Annual PDF contents #

The enriched PDF identifies organization, year, version, period and generator. Its executive summary covers activity, contributors, active domains, maturity average and priority weaknesses. It adds monthly, domain, action and contributor rankings, all ten maturity domains and rationales, methodology, and the activity ledger as an appendix. The appendix reports sealed-event integrity without exposing sensitive before/after values or client technical data.

Domains, calculations and permissions #

The radar covers IAM, governance, risk, assets, vulnerabilities, detection and response, continuity, third parties, compliance and awareness. An assessed value accepts 0 to 5 in 0.5 increments and requires a non-empty rationale up to 1,000 characters. Average and weaknesses exclude unassessed domains.

Readers can view years, report and maturity. Risk managers can save assessments and generate snapshots. A snapshot copies the current activity, classifications and maturity, receives an increasing version and remains immutable. Correct source data and generate a new version rather than editing a previous one.

Annual reports API #

The year must contain four digits. PDF is the default format. Unknown IDs return NOT_FOUND; formats other than PDF or JSON return UNSUPPORTED_FORMAT. PDF responses use application/pdf, an attachment filename and X-Content-Type-Options: nosniff.