Illustrative sample·Harbor & Pine Supply Co. is a fictional business. It shows the format and depth of a real null systems audit.
Illustrative sample: Harbor & Pine Supply Co. is a fictional business. It shows the format and depth of a real null systems audit.
Sample audit
Harbor & Pine Supply Co.: Infrastructure Audit
Business
online home-goods retailer, 24 staff, about 1,800 orders a month.
Stack reviewed
WordPress store, Google Workspace email, one cloud server, three automation tools.
Summary
The store works, but it depends on undocumented setup and one departed freelancer's accounts. Three issues threaten revenue directly: slow checkout, email landing in spam, and a backup that has not been tested. All three can be fixed within 30 days.
Findings
| # | Finding | Risk | Fix | Effort |
|---|---|---|---|---|
| 1 | Domain registered under a former freelancer's personal account | High | Transfer to a company-owned registrar account with MFA | 1 day |
| 2 | DMARC set to "none" and DKIM missing on the marketing sender | High | Publish DKIM, move DMARC to quarantine after monitoring | 2 days |
| 3 | Checkout page loads in 4.8 seconds on mobile | High | Image and script optimization, caching, hosting upgrade | 1 week |
| 4 | Last successful backup 11 months old, never restored in a test | High | Daily offsite backups, plus a restore test | 2 days |
| 5 | Four staff share one admin login | Medium | Individual accounts, MFA and role-based access | 1 day |
| 6 | 14 plugins out of date, two with known vulnerabilities | Medium | Update, remove unused plugins, schedule monthly patching | 2 days |
| 7 | Order data copied to the CRM by hand each morning | Medium | Automate the sync, with failure alerts | 1 week |
| 8 | No uptime monitoring, so outages are found by customers | Medium | 24/7 monitoring with alerting | 1 day |
| 9 | No documentation of how anything connects | Low | One-page system map and access register | 3 days |
30-60-90 day roadmap
| Window | Focus | Outcome |
|---|---|---|
| Days 1 to 30 | Findings 1, 2, 4, 5 and 8 | Domain secured, email reaches inboxes, recoverable backups, monitored |
| Days 31 to 60 | Findings 3 and 6 | Faster checkout, patched site |
| Days 61 to 90 | Findings 7 and 9 | Order sync automated, everything documented |
Recommended package
Engine. The store drives revenue and needs monitoring, daily backups and monthly improvements. Identity's email and domain work is included in Engine.
What we would leave alone
Google Workspace and the current payment provider are sound. We would keep both.