Sample report: The Internet Store
The Internet Store is a fictional online retailer with about 70 staff. Its answers went through the same engine that writes every customer’s report, and nothing in either PDF was edited by hand.
The business ran the full assessment and NISTquick on the same answers, so the two reports show what each scope covers. The story of the business follows below.
Full assessment report
106 controls, 28 pages
Overall score 3.43 out of 5
NISTquick report
44 controls, 18 pages
Overall score 3.59 out of 5
NISTquick scores 3.59 and the full assessment 3.43 on the same answers. The full assessment covers 62 more controls, including some the business does less well.
A business that is new to this work usually scores lower than The Internet Store, a 70-person retailer at 3.43 with a security manager on staff.
The business
The Internet Store sells home, kitchen, and outdoor goods online. It was founded in 2012 and turns over between $10 million and $50 million a year.
About 30 people work at the head office, across leadership, merchandising, marketing, customer service, finance, and a two-person IT team. About 35 work at a leased fulfillment warehouse nearby, rising to 60 with seasonal staff before the November peak. Four customer service agents work from home.
Most sales come through its own storefront on a hosted e-commerce platform. The rest come through one large online marketplace and a wholesale account with a regional retail chain. About 350,000 customers have accounts. Card payments go through the platform’s hosted checkout, so the business never handles card numbers.
The founder is still the CEO. The CFO is the executive owner of security, and an IT and Security Manager runs it day to day.
Why it is assessing now
Three pressures arrived in the same quarter.
- The cyber insurance renewal is due. It falls in the first quarter of 2027, and this year the insurer added questions about how the business vets and monitors its suppliers.
- The wholesale customer sent a security questionnaire. It is the first one the business has received, and the new contract carries a 72-hour breach notice clause.
- An old login turned up. Preparing for the questionnaire, the IT and Security Manager found the former marketing agency's account still active in the storefront admin, nine months after the contract ended.
The CFO wants a clear read of where the business stands before it pays a consultant for a formal assessment next year. The business has never had one. Its only reviews have been the card-industry self-assessment, the insurer’s forms, and a yearly penetration test of the storefront code.
Its security history shaped what it has built. A wave of logins with stolen customer passwords led to the IT and Security Manager’s hire, round-the-clock monitoring, and the current controls. In spring 2025, a fake supplier email asked accounts payable to change bank details. The callback rule caught it before any money moved.
Systems in place
Everything runs in the cloud, and the business has no servers of its own. The weak edge is the storefront: its apps and logins sit outside the sign-in, logging, and monitoring that cover everything else.
Identity and sign-in
Microsoft 365 Business Premium with Entra ID. Conditional Access requires multi-factor authentication (MFA) for every staff account, and administrators and finance use hardware security keys. Single sign-on, one login for many tools, covers the ERP (the system that runs orders, inventory, and finance), the help desk, and the marketing tools.
Gap: Storefront and marketplace logins are held in those platforms, outside Entra ID and its quarterly review.
Laptops and PCs
About 55 company laptops and 8 packing-station PCs, all enrolled in Intune with a security baseline, disk encryption, and automatic updates. Staff are standard users.
Gap: None material.
Phones
Staff use their own phones for email and Teams under Intune app protection.
Gap: None material.
Warehouse devices
30 handheld scanners and 12 label printers on their own network.
Gap: The scanners are past the vendor's support date, with no replacement plan.
Endpoint protection and monitoring
Endpoint detection and response, software that spots and stops attacks on each device, runs on every laptop and PC. A managed detection and response provider watches its alerts around the clock, along with Microsoft 365 and both firewalls.
Gap: The provider does not see the storefront or the ERP.
Microsoft 365 with advanced filtering, and email authentication fully enforced.
Gap: None material.
Storefront
A hosted e-commerce platform with about 25 add-on apps for reviews, loyalty, subscriptions, search, and shipping rates. Two in-house developers and a development agency build the theme and custom apps, with reviewed code changes and dependency checks.
Gap: Marketing installs apps without a security check, and no one watches what the apps, the agency, or platform support do in the admin.
Payments
The platform's hosted checkout and its fraud screening. Bank payments need a second approver, and any change of bank details needs a callback to a known number.
Gap: None material.
Back office
The cloud ERP, a cloud warehouse management system, shipping software, a help desk, and an email marketing platform.
Gap: Customer data is copied into the marketing platform, the help desk, analytics, and exported spreadsheets, and nobody has mapped where.
Backups
Microsoft 365 is backed up to a separate service with locked retention. The ERP and the storefront export each night to separate cloud storage that cannot be altered. Restores are tested each quarter.
Gap: None material.
Network
Firewalls at the office and the warehouse separate office devices, warehouse devices, and guest Wi-Fi. A backup mobile line serves the warehouse. Nothing is reachable from the internet.
Gap: None material.
Buildings
Badge access, visitor sign-in, cameras, and an alarm at both sites.
Gap: Alarm and camera checks are not scheduled.
An assessment for your business
Every assessment starts free. The business answers the questions and sees a preview of its results before deciding whether to pay for the full report.
The Internet Store, its staff, and its suppliers are fictional. The report names its people by position only.
A shorter first step
The free health check is ten questions in the browser, with no account, and it shows up to three areas to look at first.