Mohsin Anwar Sharif

Checking that a rollout delivered what it promised

After each platform went live, I wrote a post-implementation assessment for my team: a terms of reference setting the scope, then a printed checklist where every check had an owner, evidence and a manager's signature. I did this for Defender, SentinelOne, Darktrace and Zscaler.

The method

Scope it. A terms of reference sets the objectives, the components in scope, the stakeholders to interview, the frameworks to map against (NIST CSF, CIS, ISO 27001) and the timeline.
Define each check. Every check says what good looks like and how it will be verified, before anyone looks.
Evidence every result. Each result points to a screenshot or export. No evidence, no pass.
Judge it. Pass, partial, fail or not applicable, with a remark for anything that is not a pass.
Sign it off. The assessor and the manager sign the printed copy, and every failure becomes a tracked action.

Sample checklist: Microsoft Defender for Endpoint

Try it: set results and remarks, then print it to see the signed-off version.

OrganisationFictional Bank Ltd

ScopeDefender for Endpoint with Intune

AssessorEndpoint security

PeriodPost go-live review

#	Area	What good looks like	How verified	Owner	Evidence
1	Onboarding coverage	In-scope devices onboarded, compared with the asset inventory	Inventory export vs Defender device list	Endpoint team	EV-01
2	Sensor health	Onboarded devices report an active sensor and recent telemetry	Device health report, filtered for inactive or impaired	Endpoint team	EV-02
3	Real-time and cloud protection	Enabled everywhere and not overridable by users	Intune antivirus policy plus device sample	Endpoint team	EV-03
4	Tamper protection	Enabled across the tenant	Portal setting plus device sample	Endpoint team	EV-04
5	Attack surface reduction	ASR rules in block or audit mode as approved	Intune ASR policy vs approved rule list	Endpoint team	EV-05
6	Firewall policy	Windows Firewall profiles enforced	Intune policy assignment report	Endpoint team	EV-06
7	Device compliance	Compliance policy uses the Defender device risk level	Intune compliance policy settings	Intune admin	EV-07
8	Conditional access	Non-compliant devices blocked from corporate apps	Entra conditional access policy	Identity team	EV-08
9	Alerts reach the SIEM	A test detection on a lab device appears in the SIEM	Test alert plus SIEM search	SOC	EV-09
10	Automated investigation	Automation level set as approved	Portal settings	SOC	EV-10
11	Role-based access	Portal roles follow least privilege	Role assignment export review	Security admin	EV-11
12	Vulnerability view	Secure Score and vulnerability findings reviewed, owners assigned	Score export and action list	Vulnerability team	EV-12

Assessed by

Date and signature

Reviewed and approved by (manager)

Date and signature

Comments

Same template, other platforms

I wrote one of these after each rollout. The structure stays the same; the checks change.

SentinelOne

Policy mode set per group as approved
Exclusions ticketed, risk-approved and time-limited
Console certificate expiry monitored
Agent versions within support

Darktrace

Sensors cover the agreed network segments
Known scanners labelled to cut false positives
Alerts routed to the SOC

Zscaler

All users forwarded through the proxy
SSL inspection bypass list approved
Blocklists current
URL and application policy per group

The originals stayed with the bank. This page shows the structure, rebuilt on fictional data.