Simulated audit · Fictional company Botium Toys · Fall 2026
Internal Security Audit (Simulated)
A simulated internal security audit of the fictional organization Botium Toys, completed as part of my cybersecurity training: controls, compliance, risk, and prioritized remediation. Overall risk level: High.
01
Scenario
Botium Toys is a fictional organization from a cybersecurity training scenario. I reviewed its audit scope, goals, and risk assessment, then evaluated its administrative, technical, and physical controls and compliance considerations.
02
Methodology
- ScopeReviewed audit scope, goals, and risk assessment
- ControlsEvaluated administrative, technical, and physical controls
- GapsIdentified threats, vulnerabilities, and security gaps
- ComplianceAssessed controls against compliance considerations
- ImpactEvaluated potential impact of each weakness
- PrioritizeRanked risks by impact
- RecommendWrote remediation recommendations
03
Risk Heat Map
Access ControlHigh
Data ProtectionHigh
Business ContinuityHigh
AuthenticationHigh
Threat DetectionHigh
Legacy SystemsMedium
04
Findings & Recommendations
| Priority | Finding | Recommendation |
|---|---|---|
| Critical | Least privilege / separation of duties not implemented | RBAC and least privilege, periodic reviews |
| Critical | Sensitive data not encrypted | Encrypt at rest and in transit |
| High | No adequate backups or DR plan | Automated backups; tested DR plan |
| High | Weak password policy, no password manager | Stronger requirements, MFA, password manager |
| High | No intrusion detection system | Deploy network/host IDS with review procedures |
| Medium | No legacy-system maintenance schedule | Documented patch schedule; replace or isolate |
Existing strengths: firewall, antivirus, physical locks, CCTV, fire detection.
05
Tools & Skills
- Security Auditing
- Risk Assessment
- Controls Assessment
- Compliance Analysis
- Risk Prioritization
- Remediation Planning
- Security Documentation
06
Evidence
📷Screenshot: add an image of the controls checklist or risk table
07
What I Learned
- Strong physical controls don't make up for missing access control and encryption.
- Ranking findings by impact turns a long list of gaps into a clear plan.
- Backups and a tested DR plan are security controls, not just IT tasks.
- Without an IDS, attackers can operate unnoticed for longer.