A real organisation audited on five controls, two fixed, one report

The situation

Pick an organisation that will let you — a family business, your own workplace, a small office. Inventory what it has, collect the phishing that actually reaches its people, score it on the five controls with evidence, write its one-page incident plan and its staff security card, test one alert path end to end, fix at least two things, and write the two-page report that becomes your first security portfolio piece.

What you'll be able to show

• Inventory devices, exposed services and admin accounts
• Score five controls with evidence and fix the cheapest failing one first
• Write an incident plan and a staff card people can actually follow
• Test an alert path and report what remains, honestly

What you need

• Access to the organisation's network and router, with permission in writing
• Three real phishing attempts from its people's phones or inboxes
• A document for the plan, the card and the report

Tasks

1. 1Inventory
   List every device on the network (the router's client list), every service reachable from outside, and every account with admin rights. Note anything nobody could explain.
   A correct result: Three lists, and at least one item that surprised the owner.
2. 2Real phishing, catalogued
   Collect three real phishing attempts from the organisation's people this week (screenshots). For each: what it impersonates, what it wants, the one detail that gives it away, and the procedural rule that would have defeated it regardless of how convincing it looked.
   A correct result: Three catalogued attempts with a rule for each.
3. 3Five controls, scored
   Score out of five with evidence: MFA on email? Patched? Least privilege? Segmented (guest Wi-Fi separate)? Anything exposed to the internet? Fix the cheapest failing one today and record what you did.
   A correct result: Five scores with evidence, one fix done and recorded.
4. 4The incident plan and the alert test
   One page: who is called first, how a machine gets isolated, where backups are and when last tested, which credentials get reset, who tells customers. Then make one alert actually fire (a failed-login alert, a backup failure) and confirm a human saw it.
   A correct result: The one-page plan and proof a human received the test alert.
5. 5The staff card
   One page for staff: the seven personal rules, the phishing examples they will actually receive (bank SMS, WhatsApp code request, fake job offer), and the exact name and number to report to. Give it to one person and ask them to explain it back; rewrite the parts they could not.
   A correct result: The card, and the parts rewritten after the read-back.
6. 6Fix two, write the report
   Fix at least two things from your audit (one may be the task 3 fix). Write the two-page report: what you found, what you changed, what remains and why. Give it to the owner.
   A correct result: Two fixes done and a two-page report delivered.

What to hand in

The inventory, the phishing catalogue, the five-control scorecard, the incident plan with alert proof, the staff card, and the two-page report.

How it is marked