SAGE Books is a retail bookseller that provides customers with a one-stop-shopping experience for books, magazines, and multimedia (music, DVDs, and Blu-ray). During a recent board meeting, the discussion centered on how the company can improve its operations and secure its information and information systems. Board members focused on enhancing SAGE’s e-commerce website, keeping cybersecurity at the forefront of its new website design and marketing plan. As a result of this meeting, the board decided to have an independent assessment of the cybersecurity posture of the company. The assessment was completed by Secure Tech Solutions. This organization uncovered a number of issues with SAGE Books’s security program and sent a security report detailing what was found. (See the “Independent Security Report” supporting document.)
 

As SAGE Books’s chief information security officer (CISO), you act as the leader of the cybersecurity department. You are required to review the report and write SAGE Books’s response to the proposed security improvements. You must determine the appropriate actions to take, resulting in a plan for fixing the revealed issues. Your response must be provided in a written report outlining the ways SAGE Books will improve security. This report will be given to the board of directors and upper management, including the chief executive officer (CEO). 

A.  Summarize the gaps that exist currently in the company’s security framework as described in the attached “Independent Security Report.”
 

B.  Develop mitigation strategies to address the gaps identified in the “Independent Security Report,” ensuring compliance with PCI DSS and GDPR.
 

C.  Identify three critical security staff positions and the responsibilities for each position, which must be hired to meet compliance, risk, and governance requirements using the NICE Framework discussed in the “Independent Security Report.”
 

D.  Describe at least three physical vulnerabilities and/or threats and at least three logical vulnerabilities and/or threats and how each impacts the security posture of the company based on the attached “Company Overview” document and “Independent Security Report.”
 

E.  Develop a cybersecurity awareness training program in alignment with NIST standards, including the following:

•  annual training requirements

•  specialized training requirements

•  continued awareness
 

F.  Summarize the standards required for securing organizational assets regarding policies for acceptable use, mobile devices, passwords, and personally identifiable information (PII), using regulatory or contractual sources to support your claims.
 

G.  Develop an incident response plan for the company in alignment with the attached “Independent Security Report,” following the four incident handling phases according to NIST standards.
 

H.  Develop a business continuity plan (BCP) to address potential natural disasters as described in the “Independent Security Report,” including the following phases:

•  project scope and planning

•  business impact analysis

•  continuity planning

•  plan approval and implementation
 

I.  Acknowledge sources, using in-text citations and references, for content that is quoted, paraphrased, or summarized.
 

J.  Demonstrate professional communication in the content and presentation of your submission.

Introduction

Cybersecurity has become one of the most critical priorities for organizations operating in the digital marketplace. Retail companies such as SAGE Books depend heavily on e-commerce systems, cloud technologies, payment processing systems, and customer databases to conduct daily operations and maintain customer trust. However, the rapid expansion of online platforms has also increased exposure to cyber threats, data breaches, ransomware attacks, insider threats, and regulatory violations. As a result, organizations must continuously evaluate and strengthen their cybersecurity posture to protect sensitive information and maintain compliance with industry regulations such as the Payment Card Industry Data Security Standard and the General Data Protection Regulation (NIST, 2024).

The independent security assessment conducted by Secure Tech Solutions revealed multiple weaknesses within SAGE Books’s security framework. These vulnerabilities expose the organization to operational disruptions, financial losses, legal liabilities, and reputational damage. Therefore, this report outlines the company’s response to the findings by identifying current security gaps, recommending mitigation strategies, proposing staffing improvements, addressing physical and logical vulnerabilities, and developing plans for cybersecurity awareness, incident response, and business continuity. The report also demonstrates how SAGE Books can align its cybersecurity governance with recognized standards and best practices to improve resilience and support long term organizational goals.

Current Security Framework Gaps

The independent security report identified several critical deficiencies within SAGE Books’s cybersecurity framework. One of the most significant gaps involves weak access control mechanisms. Employees reportedly share login credentials and use weak passwords without multifactor authentication. This practice increases the likelihood of unauthorized access to sensitive organizational systems and customer information. Additionally, the absence of role based access control creates excessive privileges that violate the principle of least privilege and increase insider threat risks (Whitman & Mattord, 2023).

Another major gap involves inadequate data protection and encryption practices. Customer payment information and personally identifiable information are not fully encrypted during storage or transmission. This weakness creates serious compliance concerns related to PCI DSS and GDPR requirements. Furthermore, the organization lacks comprehensive vulnerability management processes, including routine patch management, penetration testing, and security monitoring. Outdated software and unpatched systems create opportunities for attackers to exploit known vulnerabilities and compromise organizational assets (NIST, 2024).

The assessment also revealed deficiencies in employee cybersecurity awareness and incident response preparedness. Employees have not received consistent security awareness training, making them more vulnerable to phishing attacks, social engineering, and accidental data disclosures. Additionally, the organization lacks a formalized incident response plan and business continuity framework. Without established procedures, the company may struggle to contain cyber incidents efficiently and recover operations following a security breach or natural disaster.

Mitigation Strategies for PCI DSS and GDPR Compliance

To address the identified gaps, SAGE Books should implement a comprehensive cybersecurity improvement strategy aligned with PCI DSS and GDPR standards. The organization should begin by strengthening identity and access management systems. Multifactor authentication should be mandatory for all employees accessing sensitive systems and customer information. Role based access control should also be implemented to ensure users only access information necessary for their job responsibilities. Strong password policies requiring password complexity, expiration periods, and account lockout protections should further improve authentication security (PCI Security Standards Council, 2022).

The organization must also improve data protection practices by encrypting customer payment information and personally identifiable information both at rest and in transit. Encryption technologies such as Transport Layer Security and Advanced Encryption Standard can help protect sensitive data from interception and unauthorized access. Furthermore, SAGE Books should establish routine vulnerability assessments, security audits, and penetration testing to identify and remediate weaknesses before they can be exploited by cybercriminals.

Compliance with GDPR additionally requires the organization to strengthen data privacy governance. SAGE Books should develop transparent privacy notices, obtain proper customer consent for data collection, and establish procedures for responding to customer requests regarding data access, correction, and deletion. Data retention policies should also ensure that customer information is not stored longer than necessary. Continuous monitoring tools and security information and event management systems can further improve threat detection and incident response capabilities (European Union, 2018).

Critical Security Staff Positions

SAGE Books should hire several cybersecurity professionals to strengthen governance, compliance, and risk management activities. One essential position is a Security Compliance Manager. This individual would oversee regulatory compliance initiatives related to PCI DSS, GDPR, and organizational policies. Responsibilities would include conducting compliance audits, managing policy development, coordinating risk assessments, and ensuring alignment with legal and contractual obligations.

Another critical position is a Security Operations Center Analyst. This professional would monitor network traffic, analyze security alerts, detect suspicious activity, and respond to cybersecurity incidents in real time. The analyst would use intrusion detection systems, security monitoring tools, and threat intelligence platforms to protect organizational systems from attacks and data breaches. Continuous monitoring is essential for maintaining operational resilience in modern cybersecurity environments (NICE Framework, 2023).

A third important role is a Cybersecurity Awareness and Training Specialist. This employee would design and deliver security education programs for staff members throughout the organization. Responsibilities would include phishing simulations, policy training, awareness campaigns, and employee assessments. Human error remains one of the leading causes of cybersecurity incidents, making employee education a critical component of organizational security strategy.

Physical and Logical Vulnerabilities

The company faces several physical vulnerabilities that could compromise organizational security. One physical vulnerability involves inadequate facility access controls. If unauthorized individuals gain access to server rooms or administrative offices, they may steal equipment, install malicious devices, or access confidential information. Another physical threat involves natural disasters such as floods, fires, or severe storms that could damage data centers and disrupt operations. Additionally, unsecured employee workstations increase the risk of device theft and unauthorized access to sensitive systems.

Logical vulnerabilities also present significant risks to SAGE Books’s security posture. Weak passwords and shared credentials expose systems to brute force attacks and unauthorized access attempts. Unpatched software vulnerabilities create opportunities for malware infections and ransomware attacks. Furthermore, phishing attacks targeting employees may result in credential theft, financial fraud, or data breaches. These logical threats are particularly dangerous because cybercriminals increasingly rely on social engineering and automated attack tools to exploit organizational weaknesses (Whitman & Mattord, 2023).

The combined impact of these vulnerabilities can severely damage the organization’s operational stability, financial performance, and public reputation. Therefore, implementing layered security controls, physical safeguards, and employee awareness programs is essential for improving overall cybersecurity resilience.

Cybersecurity Awareness Training Program

SAGE Books should establish a cybersecurity awareness training program aligned with National Institute of Standards and Technology recommendations. Annual security awareness training should be mandatory for all employees and should cover phishing prevention, password security, acceptable use policies, data privacy requirements, and incident reporting procedures. Employees should also complete periodic assessments to measure understanding and identify areas requiring additional education (NIST, 2024).

Specialized training should be provided to employees with elevated responsibilities, such as system administrators, executives, and customer service personnel handling payment information. Technical staff should receive advanced training related to vulnerability management, secure system configuration, and incident response procedures. Executives should also receive cybersecurity governance education to improve strategic decision making and regulatory oversight.

Continued awareness activities should reinforce cybersecurity best practices throughout the year. These activities may include simulated phishing exercises, newsletters, security alerts, posters, webinars, and monthly awareness campaigns. Continuous engagement helps employees remain vigilant against evolving cyber threats and strengthens the organization’s overall security culture.

Standards for Securing Organizational Assets

The organization should establish formal security policies governing acceptable use, mobile devices, passwords, and personally identifiable information. Acceptable use policies should define authorized technology usage, prohibited activities, internet usage standards, and disciplinary consequences for policy violations. These policies help employees understand organizational expectations and reduce insider threat risks.

Mobile device policies should require encryption, password protection, remote wipe capabilities, and approved application usage for company owned and personal devices accessing organizational systems. Password policies should enforce complexity requirements, multifactor authentication, password expiration periods, and restrictions against password reuse. These standards improve authentication security and reduce the risk of credential compromise (PCI Security Standards Council, 2022).

Policies governing personally identifiable information should align with GDPR requirements regarding data collection, storage, processing, and disposal. Employees should understand their responsibilities for protecting customer privacy and reporting suspected data breaches. Strong governance frameworks ensure that organizational assets remain protected from unauthorized access and misuse.

Incident Response Plan

SAGE Books should implement an incident response plan aligned with NIST incident handling standards. The preparation phase should include developing incident response policies, assigning responsibilities, establishing communication procedures, and conducting regular training exercises. Proper preparation ensures that employees understand their roles during cybersecurity incidents and improves organizational readiness.

The detection and analysis phase involves identifying suspicious activity, analyzing alerts, determining incident severity, and documenting findings. Security monitoring tools and threat intelligence systems should support rapid identification of malicious activity. The containment, eradication, and recovery phase includes isolating affected systems, removing malware, restoring operations, and validating system integrity. Quick containment minimizes operational disruptions and prevents attacks from spreading throughout the network (NIST, 2024).

The post incident activity phase focuses on lessons learned, documentation, and continuous improvement. Following each incident, the organization should review response effectiveness, identify process improvements, and update security controls accordingly. Continuous evaluation strengthens incident response maturity and enhances future preparedness.

Business Continuity Plan

The business continuity plan should begin with project scope and planning activities that identify critical business functions, recovery objectives, and continuity priorities. Leadership teams should define roles, allocate resources, and establish governance structures for continuity management activities. Effective planning ensures organizational preparedness for emergencies and operational disruptions.

The business impact analysis phase should identify essential systems, operational dependencies, financial impacts, and acceptable downtime thresholds. Understanding the consequences of disruptions enables the organization to prioritize recovery efforts and allocate resources effectively. Continuity planning should include data backup procedures, alternate communication methods, disaster recovery sites, and emergency response protocols.

The final phase involves plan approval and implementation. Leadership should formally approve continuity strategies and ensure employees receive appropriate training. Regular testing exercises, tabletop simulations, and plan reviews should be conducted to validate effectiveness and identify areas requiring improvement. Strong business continuity planning improves organizational resilience and supports long term operational sustainability (Whitman & Mattord, 2023).

Conclusion

Cybersecurity threats continue to evolve as organizations expand their reliance on digital technologies and online business operations. The independent assessment conducted by Secure Tech Solutions revealed significant vulnerabilities within SAGE Books’s cybersecurity framework that require immediate attention. Weak access controls, inadequate data protection, insufficient employee awareness, and the absence of formal incident response and business continuity planning create substantial risks to organizational operations and customer trust.

By implementing the recommendations outlined in this report, SAGE Books can strengthen its cybersecurity posture, improve compliance with PCI DSS and GDPR requirements, and enhance resilience against cyber threats and natural disasters. Investments in security governance, employee education, incident response preparedness, and business continuity planning will support operational stability and long term organizational success. Ultimately, proactive cybersecurity management is essential for protecting organizational assets, maintaining customer confidence, and ensuring sustainable growth in the digital marketplace.

References

European Union. (2018). General Data Protection Regulation (GDPR). https://gdpr-info.eu/

National Institute of Standards and Technology. (2024). Cybersecurity framework 2.0. https://www.nist.gov/cyberframework

National Initiative for Cybersecurity Education Framework. (2023). NICE cybersecurity workforce framework. https://www.nist.gov/itl/applied-cybersecurity/nice

PCI Security Standards Council. (2022). Payment card industry data security standard version 4.0. https://www.pcisecuritystandards.org/

Whitman, M. E., & Mattord, H. J. (2023). Principles of information security. Cengage Learning.

Last Completed Projects