Prepared for
Example Firearms Retailer (fictional)
Two-location FFL with online store · 14 staff · Microsoft 365
Observed March 3 to 7, 2026 (fictional)
Overall postureNeeds attention
§1 Executive summary
The business has solid payment-network separation, but its administrator accounts, backups and email domain are exposed in ways commonly used in ransomware and invoice-fraud attacks. Two of the three critical findings (F-01, F-03) are low-effort and can be closed in the first week. The third (F-02) starts that week by separating backup credentials; immutable retention and a tested restore follow in weeks two to three. Together these address the most serious risks in this report.
- Critical
- 3
- High
- 7
- Medium
- 9
- Low
- 5
§2 Control status by area
| Area | Status | Observation |
|---|---|---|
| Microsoft 365 / Google Workspace | Partial | Legacy authentication still enabled; audit log retention at default. |
| Multi-factor authentication | Missing | MFA enforced for staff, not for three admin accounts. |
| Endpoint security | Partial | Protection on 11 of 14 devices; two POS terminals unmanaged. |
| Backups and recovery | Missing | Backups share credentials with production; no restore test on record. |
| Website security | Partial | Two e-commerce plugins out of date; admin login exposed. |
| DNS and email authentication | Missing | No DMARC policy; receiving servers are not told to reject mail that spoofs the store domain. |
| Payment environment | In place | POS network separated from office and guest Wi-Fi. |
| Privileged accounts | Missing | Former employee still holds an active admin account. |
| Incident readiness | Partial | Contacts known informally; no written first-hour plan. |
| Vendor access | Partial | POS vendor has always-on remote access with a shared login. |
§3 Findings with evidence
Excerpt: the top five of 24 findings. Every finding in a real report carries the same fields. References map each finding to CIS Critical Security Controls v8 for technical readers; the Check is not a CIS audit.
F-01 critical Privileged accounts Effort: Low Confidence: Confirmed
Administrator accounts do not require phishing-resistant MFA
- Business impact
- One phished password gives an attacker full control of email, files and user accounts.
- Affected
- Microsoft 365: 3 global administrator accounts
- Suggested owner
- IT provider
- Evidence
- Conditional access export: 3 of 3 global admins excluded from MFA policy.
- Recommendation
- Enforce phishing-resistant MFA (security keys or passkeys) on every admin account; remove standing admin rights from daily-use accounts.
- Done when
- Sign-in logs show MFA on every admin sign-in; no admin account is excluded from the policy.
- Reference
- CIS Controls v8, 6.5
F-02 critical Backups and recovery Effort: Medium Confidence: Confirmed
Backups can be deleted with the same credentials as production
- Business impact
- Ransomware that takes the domain admin account can delete the backups too, leaving no way to recover.
- Affected
- Backup console; file server; 2 POS servers
- Suggested owner
- IT provider
- Evidence
- Backup console uses the domain admin account; no immutable copy configured.
- Recommendation
- Week 1: give the backup system its own credentials with MFA. Weeks 2 to 3: enable immutable retention and run a documented test restore.
- Done when
- Backup console rejects domain admin sign-in; an immutable copy exists; a restore of the POS database succeeds and is recorded.
- Reference
- CIS Controls v8, 11.3 and 11.4
F-03 critical Privileged accounts Effort: Low Confidence: Confirmed
Former employee retains an active administrator account
- Business impact
- Anyone holding that person's password has administrator access today.
- Affected
- Microsoft 365: 1 administrator account
- Suggested owner
- Owner, with IT provider
- Evidence
- Account last used 41 days ago; owner confirmed the person left.
- Recommendation
- Disable immediately, review sign-in history, and add account removal to the offboarding checklist.
- Done when
- Account disabled; sign-in history reviewed with no unexplained activity; checklist updated.
- Reference
- CIS Controls v8, 5.3 and 6.2
F-04 high DNS and email authentication Effort: Low Confidence: Confirmed
No DMARC policy on the primary domain
- Business impact
- Fraudsters can more easily send invoices or payment changes that appear to come from the store.
- Affected
- Primary email domain
- Suggested owner
- IT provider
- Evidence
- DNS lookup: no _dmarc record. SPF present, DKIM not enabled.
- Recommendation
- Enable DKIM, publish DMARC in monitoring mode, then move to quarantine once legitimate senders are confirmed.
- Done when
- DMARC record at p=quarantine or stricter; aggregate reports show legitimate mail passing.
- Reference
- CIS Controls v8, 9.5
F-05 high Vendor access Effort: Medium Confidence: Confirmed by interview
POS vendor has always-on remote access through a shared login
- Business impact
- A breach at the vendor, or one careless technician, becomes a breach of the store.
- Affected
- 2 POS servers; remote support tool
- Suggested owner
- Owner, with POS vendor
- Evidence
- Remote support tool installed as a service; one credential shared across vendor staff.
- Recommendation
- Require named vendor accounts, on-request access sessions, and a logged approval step.
- Done when
- Remote tool disabled by default; each vendor session is approved and logged under a named account.
- Reference
- CIS Controls v8, 6.4 and Control 15
§4 Recommended order of operations
- Week 1Lock down identities and protect the backups. F-01, F-03 and the remaining admin findings, plus separate backup credentials (the first step of F-02). Low effort, large risk reduction.
- Weeks 2 to 3Make recovery real. Finish F-02: immutable retention and a documented test restore, so ransomware becomes an outage rather than an ending.
- Weeks 3 to 4Close the side doors. F-04, F-05, website plugins and unmanaged POS terminals.
- Month 2Write it down. A one-page incident plan and a quarterly access review.
§5 Readout call
We walk the owner and your IT contact through the findings, answer questions, and agree who fixes what: your IT provider, 2A Cyber, or both.
Illustrative sample. "Example Firearms Retailer" is fictional; these are not real client findings.