Action plan
One ordered roadmap per customer across every product, in three stages, with the steps and points each control earns.
Updated
On this page
A customer's Action plan turns everything RevoSecure knows about the customer into one ordered list of things to fix: Microsoft 365, email and domains, devices, patching, vulnerabilities, Active Directory, websites, sharing, code and the dark web. It's for your MSP team only; portal users don't see it.
Open it from the customer's sidebar: Action plan.
The headline
The top of the plan shows what the work is worth, for example Score 72 (C) → 88 (B) after Essentials → 94 (A) after Recommended.
Stages
| Stage | What belongs here | Examples |
|---|---|---|
| Essentials | High-impact basics that stop most real attacks; mostly quick, with little user impact | MFA for everyone, legacy sign-in blocked, SPF and DMARC, valid certificates, antivirus and firewall on every device, BitLocker, OS updates, nothing like Remote Desktop exposed to the internet |
| Recommended | The next layer once the basics are done | Authenticator instead of SMS, DKIM, security headers, modern TLS, ThreatLocker in Secured mode, third-party app patching |
| Advanced | Defence in depth | Phishing-resistant MFA, DMARC at reject, MTA-STS, DNSSEC |
Advanced items never cap the grade: with Essentials and Recommended done, a customer gets an A even if every Advanced item is still open. Click a stage to show only its controls.
Control cards
Each control shows:
- a status: Done, Partly done (for example "18 of 20 devices"), To do, Not checked yet (with the reason, see below) or Not applicable;
- why it matters;
- the user impact and effort;
- the points it earns (+6 points);
- numbered steps with the exact clicks or commands;
- links to the findings behind it.
Controls already in place are listed, collapsed, under each area. Controls left out of the customer's ideal state show as Not part of the ideal state.
Microsoft recommendations, under Identity & Microsoft 365, are the tenant's Microsoft Secure Score actions. Low-impact, low-cost actions are Recommended; the rest are Advanced.
Not checked yet
Controls the evidence can't decide yet are listed in the Not checked yet card, grouped by the real reason, with what needs doing first:
| Reason | Example | What to do |
|---|---|---|
| Set up | Connect Microsoft 365 for this customer, Add the customer's domains | Connect it or add them. Only shown when it really isn't there |
| Permission | The Revo app is missing a Microsoft Graph permission | Reconnect Microsoft 365 and approve the new permissions |
| Licence | Needs Microsoft Entra ID P1 (included in Microsoft 365 Business Premium, E3 and E5). This tenant doesn't have it. | Nothing, unless the customer upgrades. Conditional Access and stale-account checks need P1; MFA registration doesn't |
| Couldn't check | Couldn't look up titan.example.com, which the SPF record of example.com includes | Fix what the message names, if it's yours to fix; the next automatic run checks again |
| On its way | Runs automatically: first Microsoft 365 results expected within the hour | Nothing: automatic assessments fill it in |
| Run | Run an external assessment | Only when automatic assessments are off for the customer |
Work session
Work session shows the next five actions in order (Essentials first, then the most points for the least effort) as a checklist you can work through in one sitting. Ticks are your own checklist: the plan marks a control done when the next assessment or agent report confirms it.
Track the work
From each card:
- Plan or Start;
- Assign, due date and notes…;
- Not applicable or accept risk…, with a required reason. Tick Also accept the related findings to accept the control's open findings too. The findings' history and the audit log record it, and the findings reopen if you include the control again.
Across customers
Compliance in the portfolio ranks every customer by ideal-state compliance with its biggest gaps (see Ideal state). The Action plan report is the same plan as ticket-ready work items for your team (see Report types).