🔐

[ SECURITY AUDIT REPORT ]

Botium Toys
Security Audit

Google Cybersecurity Certificate · May 2026

▶ Gabriel Sotero | Compliance & GRC Analyst

// 01 — SCOPE & GOALS

What Was Audited

[ SCOPE ]

Full IT security program at Botium Toys. Includes employee devices, internal network, legacy systems, data storage, business applications, and physical warehouse operations.

[ GOALS ]

Assess existing controls and compliance practices. Identify security gaps. Map regulatory issues. Deliver prioritized recommendations to improve security posture.

🖥️

Devices & Network

🗃️

Data & Storage

⚙️

Legacy Systems

🏪

Physical Location

// 02 — RISK ASSESSMENT

Risk Score: 8 / 10

LOW RISK HIGH RISK → 8/10

[ CRITICAL ]

No encryption on payment data. All employees access PII with no restrictions.

[ HIGH ]

No IDS, no disaster recovery, no backups. Legacy systems unscheduled.

[ PARTIAL ]

Firewall active. Antivirus monitored. Physical locks and CCTV in place.

[ RISK DRIVER ]

Inadequate asset management means the IT department cannot determine which assets are most critical or at risk. This limits effective prioritization and business continuity planning.

// 03 — CONTROLS ASSESSMENT

Controls Checklist

Least PrivilegeNO

Disaster Recovery PlansNO

Password Policy (adequate)NO

Separation of DutiesNO

FirewallYES

IDSNO

Data BackupsNO

Antivirus SoftwareYES

Legacy System MonitoringPARTIAL

EncryptionNO

Password Management SystemNO

Physical LocksYES

CCTV SurveillanceYES

Fire Detection/PreventionYES

0

Controls in Place

0

Controls Missing

0

Partial

// 04 — COMPLIANCE ASSESSMENT

PCI DSS · GDPR · SOC

[ PCI DSS ]

Authorized access onlyNO

Secure storage environmentNO

Data encryptionNO

Password policiesNO

0 / 4 compliant

[ GDPR ]

EU data kept privatePARTIAL

72h breach notificationYES

Data classified & inventoriedNO

Privacy policies enforcedYES

2 / 4 compliant

[ SOC 1/2 ]

User access policiesNO

PII/SPII confidentialNO

Data integrity validatedYES

Authorized access onlyNO

1 / 4 compliant

// 05 — RECOMMENDATIONS

Priority Action Plan

[P1]

Implement Least Privilege & Separation of Duties

Unrestricted access to PII and payment data is the highest risk. Direct PCI DSS and SOC 2 violation.

[P2]

Enable Encryption for Payment Data

Credit card data is stored and transmitted without encryption — a direct PCI DSS liability.

[P3]

Create Backup & Disaster Recovery Plan

No backups means any ransomware event or system failure could be unrecoverable.

[P4]

Deploy Intrusion Detection System (IDS)

Firewall only controls the perimeter. IDS is needed for internal threat visibility.

[P5]

Strengthen Password Governance & Legacy Maintenance

Update minimum requirements, deploy a centralized password manager, and schedule legacy system checks.

[ AUDIT COMPLETE ]

Security is a
process, not a state.

8/10

Risk Score

3/12

Compliance Points

5

Priority Actions

Gabriel Sotero · Compliance & GRC Analyst · Lisbon, Portugal