Cybersecurity Stack Audit for Irvine, CA Businesses

Requires a second verification factor so a stolen password alone cannot grant access to email, VPN, or cloud applications.

• •Is MFA enforced on every user including executives, administrators, and shared service accounts?
• •Are you using app-based or hardware-key methods rather than SMS, which is vulnerable to SIM swapping?
• •Is MFA required for remote access, including VPN and remote desktop, not just webmail?

Applies rules based on location, device health, and sign-in risk to block or challenge logins that look anomalous.

• •Are sign-ins from outside the United States blocked or challenged unless travel is expected?
• •Are legacy authentication protocols that bypass MFA disabled tenant-wide?
• •Do policies require a compliant or enrolled device before granting access to sensitive data?

Limits each account to the access it needs and keeps daily-use accounts separate from privileged administrative accounts.

• •Do administrators use a separate dedicated account for privileged tasks rather than their daily mailbox account?
• •Are global admin roles limited to a small named group, with the count reviewed quarterly?
• •Are standing privileges replaced with time-limited elevation where your platform supports it?

Ensures access is removed promptly when an employee leaves or changes roles, closing a common path for data theft.

• •Is access disabled within one hour of a termination, including SaaS apps and VPN, not just the network?
• •Are former-employee accounts and forwarding rules audited rather than left dormant?
• •Are quarterly access reviews run to catch orphaned accounts and excess permissions?

Monitors device behavior to detect threats that bypass traditional antivirus, with the ability to isolate a compromised machine.

• •Does your tool detect based on behavior, not just known malware signatures?
• •Can a suspicious endpoint be isolated from the network remotely within minutes?
• •Are EDR alerts watched by people around the clock, or only during business hours?

Keeps operating systems and third-party applications current so known vulnerabilities are closed before they are exploited.

• •Are critical patches deployed within days of release, with reporting on which devices remain exposed?
• •Are third-party apps such as browsers, Adobe, and Java patched, not just Windows updates?
• •Do you scan for unpatched vulnerabilities and track remediation to closure?

Encrypts the contents of laptops and workstations so a lost or stolen device does not become a data breach.

• •Is full-disk encryption enabled and verified on 100 percent of laptops?
• •Are recovery keys stored centrally so IT can recover a device when needed?
• •Can you produce an encryption status report for an insurance or compliance audit?

Prevents users from installing unapproved software and limits local administrator rights that malware relies on.

• •Are standard users prevented from installing software without approval?
• •Are local administrator rights removed from daily-use accounts?
• •Is there a defined process for approving and deploying legitimate new applications?

Inspects inbound mail for malicious attachments and links, including links that are weaponized after delivery.

• •Are attachments detonated in a sandbox before reaching the inbox?
• •Are links rewritten and checked at click time, not only at delivery?
• •Are inbound messages that impersonate executives or vendors flagged automatically?

Validates that mail claiming to come from your domain is legitimate, reducing spoofing and protecting your brand.

• •Are SPF, DKIM, and DMARC records published and aligned for your sending domain?
• •Is DMARC set to quarantine or reject rather than monitor-only?
• •Are DMARC reports reviewed so unauthorized senders are identified and stopped?

Builds employee judgment with recurring training and simulated phishing so people become an active layer of defense.

• •Is training delivered on a recurring schedule rather than once at onboarding?
• •Are simulated phishing campaigns run regularly with results tracked by team?
• •Do repeat clickers receive targeted follow-up rather than a one-size message?

Inspects traffic at the application layer and blocks intrusions, with threat intelligence kept current through active licensing.

• •Are intrusion prevention and threat feeds licensed and updating, not expired?
• •Is encrypted traffic inspected where policy and privacy allow?
• •Is inbound access limited to only the ports and services that are required?

Separates guest, employee, server, and device traffic so a compromise in one zone cannot spread freely across the network.

• •Is guest Wi-Fi isolated from the internal business network?
• •Are cameras, printers, and other connected devices on a separate segment from workstations and servers?
• •Are rules in place to limit traffic between segments rather than allowing all internal traffic?

Provides encrypted, authenticated access for remote staff without exposing internal systems directly to the internet.

• •Is remote access protected by MFA and tied to identity, not just a shared password?
• •Are remote desktop and management ports closed to the open internet?
• •Is remote access scoped to the specific systems a user needs rather than the whole network?

Maintains backup copies that cannot be altered or deleted by an attacker and that live separately from production systems.

• •Do you follow a 3-2-1 approach with at least one copy offsite or in the cloud?
• •Are backups immutable or air-gapped so ransomware cannot encrypt or delete them?
• •Are backups encrypted both in transit and at rest?

Confirms that backups actually restore and that recovery objectives are agreed with leadership and met in practice.

• •Have you completed a full restore test within the last six months with documented results?
• •Are Recovery Time Objective and Recovery Point Objective defined and signed off by leadership?
• •Are recovery roles and escalation paths written down and known to the team?

Provides an independent backup of cloud data such as Exchange Online, SharePoint, OneDrive, and Teams beyond vendor retention.

• •Are all Microsoft 365 workloads backed up, including Teams and SharePoint?
• •Can you restore an individual email, file, or full mailbox on demand?
• •Is the backup stored independently from the SaaS vendor's own platform?

Collects and correlates logs from endpoints, identity, firewall, and cloud so suspicious activity can be detected across systems.

• •Are sign-in, endpoint, and firewall logs collected centrally rather than siloed?
• •Is log data retained long enough to investigate an incident discovered weeks later?
• •Are correlation rules in place to flag patterns a single tool would miss?

Provides people and process to triage alerts and act on real threats, whether staffed internally or through a managed service.

• •Are security alerts reviewed around the clock, including nights and weekends?
• •Is there a defined triage and escalation path so alerts do not sit unread?
• •Are detection rules tuned so genuine threats are not lost in routine noise?

Defines who does what during a security incident, including containment, communication, and legal and insurance notification.

• •Is there a written plan that names roles, contacts, and decision-makers?
• •Does the plan include notification steps for cyber insurance, legal counsel, and affected parties?
• •Has the plan been exercised with a tabletop walkthrough in the past year?