Documents and reports
"So what do I actually end up with?" Around twenty separate documents, in six formats, built on the data the platform has already collected.
Nobody shows a dashboard to the auditor
The board, the auditor, the customer who sends you a supplier questionnaire: none of them logs into your portal. They want a document. That is why the most tangible part of Dottor Box is what comes out of the platform: reports, statements, minutes, registers and exports.
They are not blank templates to fill in by hand. Every document is built from the data you already have: the scans that have run, the compliance tasks closed, the procedures written in the platform, the people trained. When you generate it, it captures the actual situation at that moment.
We have grouped them into four families, according to what they need to prove and to whom.
What you end up with, document by document
From the report for management to the register for the Garante, the Italian Data Protection Authority: each family answers a different question.
The Cyber Risk Report
The main document: an Executive summary for management, a Technical version host by host, a PowerPoint presentation with editable charts and an Excel workbook with eight sheets. You choose the sections.
The report in detail 02 · Proving a management systemCompliance documents
Procedures with a revision log, the Statement of Applicability, management review minutes, the evidence file for each standard and the internal audit report.
The five GRC documents 03 · Proving an obligation is metRegisters and exports
The system administrators' access log, the training register, lists of tasks and nonconformities, CSIRT and event reports, Microsoft Entra ID and Google Workspace posture reports.
The registers available 04 · Produce and take awayForms and exportable documentation
GDPR appointments, privacy notices and authorisation letters filled in for your people, in DOCX or PDF. And your company documentation, exportable in open formats whenever you want.
Forms and exportsSecurity reports and compliance documentation in six formats
The right format depends on who uses it: the PDF is handed over, the PowerPoint is presented, the Excel file is worked on.
| Format | Documents |
|---|---|
| Cyber Risk Report (Executive and Technical), procedure document, Statement of Applicability, review minutes, evidence file per framework, audit findings report, CSIRT report, event report, Entra ID and Google Workspace posture reports, supplier questionnaire report, documentation export | |
| PPTX | Cyber Risk Report presentation, with native editable charts |
| XLSX | Eight-sheet workbook of assets and vulnerabilities, list of compliance tasks, list of nonconformities |
| CSV | Access log, training register, templates for importing master data |
| DOCX | GDPR forms, filled in for the people you choose |
| MD, HTML, TXT, ZIP | Company documentation export by page, chapter or whole book |
Documents that stand up to scrutiny
A document is only as good as its traceability. These are the details an auditor notices, and they make the difference between a file produced the night before and evidence.
- Your company's letterhead on compliance documents, not our brand
- The TLP classification on the cover page, to say who may receive the document
- The revision log that fills itself in with every saved version
- The sections not filled in in the review minutes are marked, not hidden
- In posture reports, acceptances with their justification next to the score
- Every chapter of the report opens with the methodology: what was checked and how
Your company documentation is not locked into the platform: it can be exported to PDF, HTML, Markdown or plain text, and a whole book to a ZIP archive.
What you write in Dottor Box stays yours
For partners, the Cyber Risk Report comes out branded with the partner's name: the reseller's logo and details on the cover. The partner programme.
Which standards it supports
Every standard asks you to prove, not just to do. These documents are the evidence you take to the assessment.
The history and the people behind the documents
Reporting
Executive, technical and presentation reports with editable charts, generated automatically too.
Learn more ProveTime Machine
The calendar of checks from the last 180 days and the archive of weekly reports.
Learn more GovernCompliance and GRC
Policies, procedures, audits and evidence for eight frameworks: one piece of work that counts for several standards.
Learn moreDo you know what someone looking for a target can see of your company?
In a demo on your real systems we show you what is exposed, how much it matters and where to start. Then, if you need it, a tailored proposal.