Back to the archive
    ARC-002CONFIDENCIAL · AnonimizadoALTO

    CIA Triad maturity analysis: gaps, attack surface and prioritised plan

    Structured evaluation of confidentiality, integrity and availability on an organisation with on-prem + cloud infrastructure (M365, AD, VPN). Average score 4.5/10 — insufficient versus minimum GDPR standard. Availability is the immediate critical area; confidentiality carries the highest regulatory exposure.

    Analysis type
    Cybersecurity audit · CIA Triad
    Sector
    Mid-sized organisation · Hybrid IT
    Status
    Closed · Remediation plan delivered
    Date
    2025
    CIA TriadCIS v8MFABCPSIEMAuditoríaRGPD
    01

    Context

    • ·Organisation handling customer data under GDPR with critical digital operations.
    • ·Documentary review + technical interviews + configuration inspection + past-incident analysis.
    • ·Framework: CIA Triad complemented with CIS v8 controls as sector reference.
    02

    Methodology

    • ·Per-pillar evaluation with 0–10 scoring and qualitative level.
    • ·Cross-pillar gap mapping to identify combined attack surface.
    • ·Remediation plan prioritised by risk-reduction / implementation-effort ratio.
    03

    Findings

    01MFA not implemented on VPN or M365
    CRÍTICO
    02Backups not verified in the last 6 months
    CRÍTICO
    03No formal or tested BCP
    CRÍTICO
    04Incomplete logs · retention <30 days
    ALTO
    05No network segmentation for critical systems
    ALTO
    06No least-privilege policy
    ALTO
    04

    Operational impact

    • ·Elevated, sustained cyber risk for a GDPR-applicable organisation.
    • ·A ransomware incident could mean permanent data loss and business halt.
    • ·Highest-impact actions (MFA, backup verification, admin revocation) are low technical and economic cost.
    05

    Full document

    RESTRICTED ACCESS
    10 pp· 78 KB· PDF

    Document from the private archive

    This report is part of Zero101OSINT's private research archive. Access is individual, logged and traceable. No spam, no mailing list.

    Basic privacy information. Project: Zero101OSINT. Legal identity of the controller: pending owner confirmation. Manage the requested document and record the access request.

    Technology and email providers may process the submitted data. Legal basis, retention periods and international transfer arrangements remain pending owner confirmation. This request does not authorize advertising.

    Rights: access, rectification, erasure, objection, restriction and portability, where applicable. Contact: contacto@zero101osint.com. Privacy policy.

    PDF delivered through a temporary signed URL. The access request is recorded.