EfocusLearning

Security Assessment Report

Efocus Consultant

6 staff

Assessment date: 24 June 2026

Security Maturity

Low

Risk Rating

Critical

Key Security Gaps Identified

  • No Multi-Factor Authentication (MFA) — anyone who steals a password can access company accounts immediately
  • No antivirus or endpoint detection and response (EDR) — devices have no protection against malware or ransomware
  • No email security — staff are fully exposed to phishing, spam, and business email compromise attacks
  • No firewall — no barrier between the company network and external threats
  • No backup solution — a ransomware attack or hardware failure could result in permanent loss of all company data
  • No SIEM or threat monitoring — there is no way to detect if the company is currently being attacked or has already been breached
  • No data protection tools — sensitive personal, financial, and intellectual property data is stored with no safeguards
  • No security policies — staff have no guidance on what is or is not acceptable when handling company data and systems
  • No incident response plan — if something goes wrong, there is no plan for how to respond, recover, or report the incident
  • No business continuity plan — a cyberattack or system failure could shut down operations indefinitely
  • No risk register — the company has not formally identified or documented the risks it faces
  • No phishing awareness training — staff are the first line of defence and currently have no training to recognise threats
  • No vulnerability scanning — no visibility into weaknesses in systems or software that attackers could exploit
  • No ticketing or incident tracking system — security issues cannot be logged, tracked, or resolved in an organised way
  • On-premises data storage with no documented controls — sensitive data stored locally with no clear access restrictions or audit trail

Recommended Security Tools

Microsoft Authenticator (MFA app) — to secure all logins with a second verification stepMicrosoft Defender for Business — antivirus and endpoint protection built for small businessesMicrosoft Defender for Office 365 — email security to block phishing, malware, and spamMicrosoft Entra ID (formerly Azure AD) — identity and access management to control who can access whatMicrosoft Purview (Basic) — to classify and protect sensitive dataMicrosoft OneDrive / SharePoint with version history — basic cloud backup and file recoveryMicrosoft Sentinel (Lightweight) — security monitoring and alerting for small environmentsHardware or software firewall — to protect the on-premises network from unauthorised accessMicrosoft Intune — to manage and secure company devices

Recommended Azure Security Stack

Microsoft Entra ID (P1) — Conditional Access, MFA, and identity protectionMicrosoft Defender for Business — endpoint protection across all staff devicesMicrosoft Defender for Office 365 Plan 1 — anti-phishing, safe links, safe attachmentsMicrosoft Purview Information Protection — label and protect sensitive documentsMicrosoft Sentinel — cloud-native SIEM for threat detection and alertingMicrosoft Intune (via Microsoft 365 Business Premium) — device management and complianceMicrosoft 365 Business Premium — bundles most of the above at a cost-effective price for small businessesAzure Backup — for backing up on-premises and cloud workloads

Recommended Awareness Training

  • Phishing awareness — highest priority given zero email security and no staff training
  • Password security — critical as MFA is not yet in place and passwords are the only protection
  • MFA training — staff will need to understand and adopt MFA as it is rolled out
  • Data protection/GDPR — company handles personal and financial data of African customers
  • Ransomware awareness — no backup or endpoint protection currently in place
  • Incident reporting — staff need to know how to report suspicious activity immediately
  • Social engineering — small teams are frequent targets of manipulation-based attacks

Recommended EfocusLearning Services

  • 1Build Microsoft 365 security baseline — establish foundational security across the Microsoft 365 environment
  • 2Configure Entra ID and MFA — protect all accounts with multi-factor authentication immediately
  • 3Set up Conditional Access — ensure only the right people, on the right devices, can access company data
  • 4Configure Defender for Office 365 — protect staff from phishing and malicious emails
  • 5Build incident response process — give the company a clear plan for what to do when something goes wrong
  • 6Provide staff security policy pack — give the company written policies covering acceptable use, passwords, data handling, and more
  • 7Provide cyber awareness training — train all 6 staff members to recognise and respond to cyber threats
  • 8Configure Microsoft Sentinel — set up basic monitoring so threats can be detected early
  • 9Provide monthly security monitoring and reporting — ongoing support to keep the company protected after initial setup

Implementation Roadmap

1

Phase 1 — Emergency Foundations

Week 1–2

Address the most critical and immediately exploitable vulnerabilities. Enable MFA for all 6 staff accounts via Microsoft Entra ID. Activate Microsoft Defender for Business on all devices. Enable Defender for Office 365 to block phishing and malicious emails. Set up basic Conditional Access policies to block risky sign-ins. Deliver Phishing Awareness and Password Security training to all staff. This phase alone dramatically reduces the risk of account takeover and email-based attacks.

2

Phase 2 — Data Protection & Backup

Week 3–4

Protect the company's sensitive data and ensure it can be recovered if lost. Configure Microsoft Purview to label and protect personal, financial, and intellectual property data. Set up OneDrive and SharePoint with version history for cloud-backed file storage. Configure Azure Backup for on-premises systems. Deliver Data Protection and Ransomware Awareness training to all staff. This phase ensures business data is not permanently lost in the event of an attack or hardware failure.

3

Phase 3 — Policies, Processes & Governance

Month 2

Give the company the written frameworks it needs to operate securely. Deliver a full Staff Security Policy Pack covering acceptable use, password policy, data handling, and device use. Build a documented Incident Response Plan tailored to the company's size and setup. Create a basic Risk Register identifying the company's key cyber risks. Build a phishing investigation workflow so incidents can be handled consistently. Deliver Incident Reporting and Social Engineering training modules to all staff.

4

Phase 4 — Monitoring & Continuous Improvement

Month 3 and ongoing

Enable ongoing visibility and long-term resilience. Configure Microsoft Sentinel for basic security monitoring and alerting. Set up a simple ticketing process for logging and tracking security issues. Implement a monthly security monitoring and reporting service with EfocusLearning. Conduct a post-implementation review and update the risk register. Schedule quarterly awareness training refreshers. This phase ensures the company does not remain static and can detect and respond to threats as they evolve.

Monthly Support Package

Recommended Package: Essential Monthly Security Monitoring — Given the company's size of 6 staff and a single in-house cybersecurity resource, EfocusLearning recommends a monthly support retainer that includes: (1) Monthly security health check and report covering Microsoft 365, Entra ID, and Defender alerts; (2) Review of any security incidents or anomalies flagged during the month; (3) Policy and configuration updates as Microsoft releases new features or threats emerge; (4) Quarterly awareness training refresh for staff; (5) Priority access to EfocusLearning consultants for incident support. Estimated cost range: ₦150,000 – ₦250,000/month (approximately $100–$170 USD/month), adjusted based on scope of monitoring and response SLA agreed. This package ensures the lone internal security person has expert backup and the company maintains its protections over time without requiring a large internal team.

Why This Matters

Given that Efocus Consulting operates in Nigeria, the company must comply with local regulations regarding the storage and handling of personal and financial data. Non-compliance can lead to hefty fines and damage to the company's reputation. EfocusLearning can help by implementing essential controls and frameworks to ensure compliance and safeguard sensitive information, ultimately strengthening customer trust and business viability.

Location & Regulatory Scope

Company Country

Nigeria

HQ Location

Lagos, Lagos, Nigeria

Operating Regions

Nigeria

Customer Data Origins

African Customers

Data Storage

On-Premises

Cross-Border Transfer

No

Sensitive Data Types

Personal Data, Financial Data, Intellectual Property

Regulatory & Compliance Intelligence

Current Compliance

10%

After EfocusLearning

85%

Business Risk

Critical
Data Sovereignty Risk: MediumCross-Border Transfer Risk: Low
0
NaN%
1
NaN%
2
NaN%
3
NaN%

Missing Security Controls

No MFA
No Antivirus or EDR
No Email Security
No Firewall
No Backup Solution
No SIEM or Threat Monitoring
No Data Protection Tools
No Security Policies
No Incident Response Plan
No Business Continuity Plan
No Risk Register
No Phishing Awareness Training
No Vulnerability Scanning
No Ticketing or Incident Tracking System

Recommended EfocusLearning Services

No MFA→Entra ID Security ImplementationHigh priority
No Security Awareness Training→Cyber Awareness Training ProgrammeHigh priority
No SIEM→Microsoft Sentinel DeploymentHigh priority
No Vulnerability Scanning→Vulnerability Management ServiceHigh priority
No Risk Register→GRC ConsultancyHigh priority
No Incident Response Plan→Incident Response ProgrammeHigh priority
No Third Party Risk Management→TPRM Assessment ServiceMedium priority

Required Controls for Nigeria

Data Protection PoliciesUser Access ManagementIncident Response ProceduresBackup and Recovery Solutions

Security Maturity Roadmap

1

Critical Foundations

0% → 20%

Establish the critical security elements to protect sensitive data and user accounts, including authentication, email defenses, and data backup procedures.

MFASecure Password PolicyEmail SecurityEndpoint ProtectionSecurity Awareness TrainingBackup Verification
2

Essential Security Controls

20% → 40%

Implement essential controls that enhance security posture and compliance capabilities, focusing on access management, vulnerability handling, and data governance.

Conditional AccessVulnerability ManagementDevice ComplianceLoggingData Classification
3

Monitoring & Detection

40% → 60%

Introduce monitoring and detection mechanisms that can identify and respond to security threats effectively.

Microsoft SentinelThreat DetectionSecurity Incident ProcessThreat Intelligence
4

Governance & Compliance

60% → 80%

Embed governance and compliance frameworks into the organization to ensure ongoing risk management and accountability.

Risk RegisterSecurity PoliciesDPIASupplier Risk Management
5

Advanced Security & Resilience

80% → 100%

Achieve advanced security measures that significantly bolster resilience against sophisticated threats and ensure compliance with high standards.

Zero TrustSecurity AutomationSOARRed Team TestingAdvanced Threat Hunting

Standard Recommendations for Your Company Size

Size tier: 1-10 staff

Microsoft 365 security baseline
MFA
Defender for Office 365
Basic awareness training
EfocusLearning

This report was prepared by EfocusLearning as part of a security assessment. Contact us to discuss how we can help strengthen your security posture.