Phase 1
During the initial audit, it was discovered that training for all employees has not been implemented. Security measures are not in place to prevent protection from physical threats. Network security measures have not been implemented with a firewall, or with an antivirus system to prevent malware. Cross functionality of the systems are not considered with respect to the disaster recovery, incident response planning. The IT department does not have the diagram of the infrastructure mapped out with a topology which would also aid in the event of a disaster or other incident. Permissions are not enforced with appropriate industry standards, acknowledging the laws of least privilege. Policies and procedures should be implemented and enforced to mitigate security issues, and should be updated no less than annually.

Phase 2
Lack of information technology governance can harm a company in many ways. Ensuring that employees with roles of protecting the infrastructure have the proper training and support of senior management will help to support security and compliance concerns. Failure to adhere to industry best practices can lead to compliance concerns, loss of confidentiality of data and potentially it can lead to lawsuits.

Without proper permissions access monitoring, the company cannot enforce policy or procedures. This can lead to virus or malware infiltrating your network, which can cause an interruption in productivity, loss of revenue and can ultimately cause damage to the company’s reputation.

Phase 3

Key findings above are best mitigated with the following:
• Enforce firewall security as the router to avoid outside access
• Remove Telnet access as it is not secure
• Install an antivirus program, with routine updates
• Implement employee training at all levels, providing written documentation on the type of training and those in