What’s new.
What’s next.

You come to a service to get something done. Signing up and signing in should help you get there without making you puzzle through unfamiliar steps. The challenge is making that experience clear while protecting your account and the information you are trusted to use.

Identity and permissions are different

Confirming access to an account and deciding what that account may do are separate jobs. Being signed in should not automatically mean being able to see or change everything.

That distinction matters when people work together. Someone may need to read information, another person may need to update it, and someone else may be responsible for managing access. Getting those boundaries right helps protect personal and organisation information while giving people the access they need.

Recovery needs the same care

People forget passwords, lose devices and change contact details. A service needs to consider those ordinary situations.

The challenge is helping the account holder get back in while preventing someone else from taking over. A useful recovery process needs clear instructions and appropriate checks. Making recovery easy at the expense of protection would weaken the account; making it impossible to understand would leave people stranded.

Helpful messages need to protect privacy

When something goes wrong, people need a useful next step. A vague error can lead to repeated attempts and frustration.

At the same time, a sign-in message should avoid revealing private information about another person’s account. That creates a real writing challenge: explain what someone can do next without disclosing more than they need to know. Clear, calm language can help people continue while respecting the privacy of account holders.

Security needs to be usable

People use different devices and have different access needs. A sign-in flow should make sense on a small screen and work for someone using a keyboard or assistive technology.

Clear labels, understandable instructions and support for tools such as password managers can reduce unnecessary effort. Extra steps should have a purpose people can understand. The goal is to help people make safe choices without expecting them to become security experts just to use a service.

The whole journey matters

A successful first sign-in is only one moment. People pause tasks, switch devices, sign out and return later. Their responsibilities may change, and their access may need to change with them.

Good account security needs to consider that whole journey, including signup, recovery and returning to work. Checking each screen in isolation can miss problems between the steps.

The lesson is to judge sign-in by what it means for the person using it: a clear way in, a safe way back, appropriate access and confidence about the next step. Those are the customer benefits that careful work should support.

Further reading:

• OWASP: appropriate access
• OWASP: authentication and privacy
• NIST: account recovery and changes over time
• W3C: accessible sign-in

The planned steps are to confirm your email, set up your account, choose Company or Consultant, complete an assessment and return after signing out.

Signup and sign-in are being tested and reviewed. The complete process has not been released. Desktop, mobile and keyboard use, saving answers and returning to them still need to be checked together on the live product.

The next update will identify what has passed release checks and what still needs work. There is no confirmed launch date.

A board report needs a record of what was assessed and when. This work can save a draft snapshot’s scoring inputs and check that the same inputs give the same result.

Assessment completion, implementation attainment and evidence coverage remain separate measures. A later assessment should not silently rewrite an earlier snapshot.

Reporting is not released. Dashboard connections, report history, access controls and downloadable PDFs still need work. No customer report export has launched.

Starting signup again with another email no longer keeps a returning customer stuck in the earlier setup process.

This navigation change is live. Email-and-password signup and the complete process of assessing, saving and returning are still being developed and checked.

The planned Overview and executive summary will explain your organisation’s IT position using saved assessments. They are not released. This work uses saved assessments rather than an automatic live feed.

• Overview and executive summary: clearer assessment progress, implementation ranges, evidence coverage and gaps.
• Evidence and improvement actions: planned document uploads and links between evidence, actions, owners and dates.
• Current scores and history: planned updates from authorised information, with source dates and missing or stale evidence made clear.
• Board reporting: tested snapshot work, with dashboard integration and PDF export still to come.

These features are being developed in stages. Signup, sign-in and returning to saved work come first. Release dates have not been set.