EfocusLearning

Security Assessment Report

Text ltd

Hospitality • 10 staff • Hybrid

Assessment date: 24 June 2026

Security Maturity

Low

Risk Rating

Critical

Key Security Gaps Identified

  • No antivirus or endpoint protection on any devices — staff laptops and phones are completely unprotected
  • No Multi-Factor Authentication (MFA) — anyone who steals a password can access company accounts immediately
  • No email security — the business is wide open to phishing attacks and email fraud
  • No firewall in place — no barrier between the internet and the company's systems
  • No backup solution — a ransomware attack or accidental deletion would result in permanent data loss
  • No data protection tools or GDPR controls — a serious legal and regulatory risk in the hospitality sector
  • No threat monitoring or SIEM — there is no way to detect if the business is being attacked or has already been compromised
  • No incident response plan — staff would not know what to do in the event of a cyberattack
  • No business continuity plan — a cyber incident could halt operations indefinitely with no recovery path
  • No security policies documented — staff have no guidance on acceptable use, passwords, or data handling
  • No risk register — the business has never formally identified or tracked its cybersecurity risks
  • No phishing awareness training — staff travelling regularly are prime targets for social engineering and phishing scams
  • No user access management — no controls over who can access what data or systems
  • No Microsoft 365 or cloud security platform in use — the business lacks even a baseline productivity and security foundation
  • Single IT and cybersecurity resource creates a critical single point of failure with no redundancy

Recommended Security Tools

Microsoft 365 Business Premium (includes email, Teams, Defender, Intune)Microsoft Defender for Business (endpoint antivirus and EDR)Microsoft Defender for Office 365 (email security and anti-phishing)Microsoft Entra ID (identity and access management)Microsoft Authenticator App (MFA)Microsoft Intune (mobile device and laptop management)Microsoft OneDrive / SharePoint (secure cloud file storage and backup)Microsoft Secure Score (ongoing security posture tracking)

Recommended Azure Security Stack

Microsoft Entra ID (formerly Azure AD) — for identity management and MFAConditional Access Policies — to restrict access based on location, device, and risk level (especially for travelling staff)Microsoft Defender for Office 365 Plan 1 — for email protection, anti-phishing, and safe linksMicrosoft Defender for Business — endpoint protection across all staff devicesMicrosoft Intune — device management to secure laptops and phones used while travellingMicrosoft Purview (Basic) — data classification and basic GDPR compliance controlsMicrosoft Sentinel (future phase) — cloud-native SIEM for threat detection and monitoring

Recommended Awareness Training

  • Phishing awareness — critical given staff travel and use of public networks
  • Password security — no password controls currently exist
  • MFA training — staff will need to understand and adopt MFA as a new tool
  • Secure remote working — essential for a hybrid, multi-location, travelling workforce
  • Data protection/GDPR — hospitality businesses handle guest personal data and must comply with GDPR
  • Social engineering — travelling staff are high-value targets for in-person and digital manipulation
  • Incident reporting — staff need to know how and when to report a suspected security issue

Recommended EfocusLearning Services

  • 1Build Microsoft 365 security baseline
  • 2Configure Entra ID and MFA
  • 3Set up Conditional Access
  • 4Configure Defender for Office 365
  • 5Build incident response process
  • 6Create phishing investigation workflow
  • 7Provide cyber awareness training
  • 8Provide staff security policy pack
  • 9Provide monthly security monitoring and reporting

Implementation Roadmap

1

Phase 1 — Emergency Foundations

Week 1–2

Immediately address the most critical and exploitable gaps. Deploy Microsoft 365 Business Premium across all staff, enable Multi-Factor Authentication (MFA) on every account, and activate Microsoft Defender for Business on all devices. This alone dramatically reduces the risk of account takeover and malware infection. Set up OneDrive and SharePoint for basic cloud backup so data cannot be permanently lost.

2

Phase 2 — Email Security & Access Controls

Week 3–4

Configure Microsoft Defender for Office 365 to block phishing emails, malicious links, and fake attachments. Set up Conditional Access policies in Entra ID to ensure that staff travelling abroad or connecting from unfamiliar locations face additional verification checks before accessing company systems. This directly addresses the travelling risk identified for this business.

3

Phase 3 — Policies, Training & Incident Readiness

Month 2

Deliver the EfocusLearning staff security policy pack to give the business formal written policies on passwords, acceptable use, data handling, and remote working. Launch the first round of cyber awareness training — prioritising phishing, secure remote working, and GDPR. Build a basic incident response process so the IT/security person knows exactly what to do if an attack occurs.

4

Phase 4 — Monitoring & Continuous Improvement

Month 3 onwards

Enrol in EfocusLearning's monthly security monitoring and reporting service. Begin tracking Microsoft Secure Score to measure ongoing improvements. Conduct a phishing simulation to test staff awareness. Review and update the risk register quarterly. Consider adding Microsoft Sentinel for enhanced threat visibility as the business and security maturity grows.

Monthly Support Package

Essentials Monitoring Package — Recommended at £300–£500/month. Given Text Ltd's size (10 staff, 1 IT/cybersecurity person, 2 locations), this package should include: monthly Microsoft 365 security health check and Secure Score review; review of any security alerts flagged by Defender for Business and Defender for Office 365; monthly summary report in plain English for the business owner; quarterly policy and training refresh check; and direct access to EfocusLearning for incident support if needed. This gives the single internal IT/security resource expert backup without the cost of a full-time senior security hire.

Why This Matters

Text Ltd operates in the UK hospitality sector and is legally obligated to protect guest and staff personal data under UK GDPR and the Data Protection Act 2018 — with zero controls currently in place, the business faces an immediate risk of ICO enforcement action, fines of up to £17.5 million, and severe reputational damage that could devastate a small 10-person operation should a breach occur. The complete absence of endpoint protection, MFA, backups, and incident response means a single phishing email or ransomware attack could halt operations indefinitely with no recovery path. EfocusLearning's structured implementation programme can take Text Ltd from a critical risk rating to a projected 78% compliance posture, putting the right technical controls, governance frameworks, and legal safeguards in place to protect the business, its customers, and its future.

Regulatory & Compliance Intelligence

Current Compliance

4%

After EfocusLearning

78%

Business Risk

Critical
Data Sovereignty Risk: MediumCross-Border Transfer Risk: Medium
UK GDPR / DPA 2018
4%
ISO 27001:2022
3%
NIST Cybersecurity Framework
5%
Cyber Essentials (NCSC)
2%
PCI DSS v4.0
5%

Missing Security Controls

No Multi-Factor Authentication (MFA)
No Email Security (Anti-Phishing / Anti-Spam)
No Endpoint Protection / Antivirus (EDR)
No Firewall
No Backup Solution or Recovery Verification
No SIEM or Threat Monitoring
No Incident Response Plan
No Business Continuity Plan
No Security Policies (Acceptable Use, Password, Data Handling)
No Risk Register
No Data Protection Impact Assessment (DPIA)
No User Access Management or Conditional Access
No Phishing or Security Awareness Training
No Records of Processing Activities (ROPA)
No Data Classification or Labelling
No Third-Party / Supplier Risk Management
No Vulnerability Management or Patch Management Process
No Centralised Logging or Audit Trails
No Microsoft 365 or Cloud Security Foundation
No Mobile Device Management (MDM)

Recommended EfocusLearning Services

No Multi-Factor Authentication (MFA)→Entra ID Security Implementation (MFA, Conditional Access)High priority
No Email Security (Anti-Phishing / Anti-Spam)→Defender for Office 365 ConfigurationHigh priority
No Endpoint Protection / Antivirus (EDR)→Microsoft 365 Security BaselineHigh priority
No Backup Solution or Recovery Verification→Business Continuity & Disaster Recovery PlanningHigh priority
No Phishing or Security Awareness Training→Cyber Awareness Training ProgrammeHigh priority
No Security Policies (Acceptable Use, Password, Data Handling)→Security Policy PackHigh priority
No User Access Management or Conditional Access→Entra ID Security Implementation (MFA, Conditional Access)High priority
No Microsoft 365 or Cloud Security Foundation→Microsoft 365 Security BaselineHigh priority
No SIEM or Threat Monitoring→Microsoft Sentinel Deployment (SIEM/SOAR)High priority
No Incident Response Plan→Incident Response ProgrammeHigh priority
No Risk Register→GRC Consultancy (Risk Register, Policies, DPIA)High priority
No Data Protection Impact Assessment (DPIA) or ROPA→Data Protection & Privacy Compliance (GDPR, DPIA, DSAR)High priority
No Business Continuity Plan→Business Continuity & Disaster Recovery PlanningHigh priority
No Vulnerability Management or Patch Management Process→Vulnerability Management ServiceMedium priority
No Centralised Logging or Audit Trails→Monthly Security Monitoring & ReportingMedium priority
No Third-Party / Supplier Risk Management→Third-Party Risk Management (TPRM) Assessment ServiceMedium priority
No Mobile Device Management (MDM)→Microsoft 365 Security BaselineMedium priority
No Data Classification or Labelling→GRC Consultancy (Risk Register, Policies, DPIA)Medium priority
No Cloud Security Posture Management→Cloud Security Posture ManagementLow priority
No ISO 27001 Framework or Certification Readiness→ISO 27001 Readiness ProgrammeLow priority

Required Controls for United Kingdom

Implementation of appropriate technical and organisational measures to protect personal data (UK GDPR Article 25 & 32)Multi-Factor Authentication (MFA) for all accounts accessing personal dataDocumented Data Protection Impact Assessment (DPIA) where high-risk processing occurs72-hour breach notification capability to the ICO (UK GDPR Article 33)Appointment of or access to a Data Protection Officer (DPO) or equivalent privacy functionMaintained Records of Processing Activities (ROPA) under UK GDPR Article 30Documented lawful basis for all personal data processing activitiesStaff data protection and security awareness trainingSecure and documented data retention and deletion policiesThird-party Data Processing Agreements (DPAs) with all vendors handling personal dataIncident Response Plan capable of meeting ICO notification timelinesEndpoint protection on all devices used to access personal data

Security Maturity Roadmap

1

Critical Foundations

0% → 20%

Text Ltd currently has zero security controls in place, making it critically exposed to common cyber threats including phishing, ransomware, and account takeover. This phase establishes the absolute minimum viable security foundation required to protect the business, its staff, and the personal data of its hospitality customers. Without completing this level, the business remains in breach of UK GDPR obligations and faces existential cyber risk.

Multi-Factor Authentication (MFA)Secure Password PolicyEmail Security (Defender for Office 365)Endpoint Protection (Microsoft Defender for Business)Security Awareness & Phishing TrainingBackup Solution & Verification (OneDrive/SharePoint)
2

Essential Security Controls

20% → 40%

With foundational controls in place, this phase hardens the environment by enforcing access controls based on device and user compliance, ensuring all endpoints are consistently patched, and beginning to classify the personal and sensitive data Text Ltd holds on guests and staff. Logging enables basic accountability and audit readiness, which is essential for demonstrating UK GDPR compliance.

Conditional Access Policies (Microsoft Entra ID)Vulnerability Management & Patch ManagementDevice Compliance & Mobile Device Management (Microsoft Intune)Centralised Logging & Audit TrailsData Classification & Labelling
3

Monitoring & Detection

40% → 60%

Text Ltd currently has no visibility into whether it is being attacked or has already been compromised. This phase introduces active monitoring and detection capabilities through Microsoft Sentinel, enabling the business to identify, triage, and respond to security incidents in a structured and timely manner — a key requirement under UK GDPR's 72-hour breach notification obligation.

Microsoft Sentinel SIEM DeploymentThreat Detection Rules & AlertingSecurity Incident Response ProcessThreat Intelligence IntegrationMonthly Security Monitoring & Reporting
4

Governance & Compliance

60% → 80%

This phase transitions Text Ltd from reactive security to proactive governance. Formalising a risk register, security policies, and DPIA ensures the business can demonstrate accountability to the ICO. Supplier risk management is particularly relevant given the hospitality sector's reliance on third-party booking platforms, payment processors, and property management systems.

Formal Risk RegisterDocumented Security Policies (Acceptable Use, Password, Data Handling)Data Protection Impact Assessment (DPIA)Supplier & Third-Party Risk ManagementBusiness Continuity & Disaster Recovery PlanIncident Response Plan (Documented & Tested)
5

Advanced Security & Resilience

80% → 100%

At full maturity, Text Ltd operates a proactive, intelligence-led security programme with automated response capabilities and formal certification readiness. While a 10-person hospitality business may not immediately pursue ISO 27001 certification, achieving this maturity level significantly reduces insurance premiums, strengthens enterprise customer trust, and positions the business for sustainable, secure growth.

Zero Trust Architecture ImplementationSecurity Automation & SOARRed Team / Penetration TestingAdvanced Threat HuntingISO 27001 Readiness AssessmentContinuous Compliance Monitoring

Standard Recommendations for Your Company Size

Size tier: 1-10 staff

Microsoft 365 security baseline
MFA
Defender for Office 365
Basic awareness training
EfocusLearning

This report was prepared by EfocusLearning as part of a security assessment. Contact us to discuss how we can help strengthen your security posture.