Of 212 employees who left between 1 Nov 2025 and 31 Oct 2026, 9 had active directory accounts more than 24 hours after their leaving date. The longest delay was 41 days.

Access Control Policy section 4.3: access must be removed within 24 hours of the leaving date.

42 critical vulnerabilities raised in the period remained open beyond the 14-day remediation deadline, with a median delay of 63 days. 11 of them sit on internet-facing payment gateways. No risk acceptance is recorded for any of the 42.

Vulnerability Management Standard v3.1, section 5: critical vulnerabilities must be remediated within 14 calendar days, or formally accepted by the CISO.

6 of 47 critical systems listed in the CMDB do not appear in the log source inventory. No Q3 log review record exists for the SIEM, although the procedure requires monthly review with sign-off.

Logging and Monitoring Procedure v2.0 sections 3.2 and 4.1.