Acme Holdings, Inc.

Cybersecurity Readiness Assessment

Prepared by Frontier IT Security

November 2025

Executive Summary

This memo summarizes the current state of cybersecurity controls across Acme Holdings and outlines a pragmatic, prioritized path forward. Findings are based on interviews with leadership, a review of existing policy documents, and a control-mapping exercise against the organization's stated risk posture.

The organization has a sound foundation in identity and endpoint controls. The most material gaps relate to vendor risk management, incident response readiness, and board-level reporting cadence. None of the gaps identified are emergent; all can be addressed within the next two quarters under the current operating budget.

Scope and Approach

The assessment focused on four control domains: identity, endpoint, vendor risk, and incident response. We did not perform technical penetration testing or cloud configuration review as part of this engagement.

In Scope

• •Identity and access management policies and tooling
• •Endpoint protection coverage and patch cadence
• •Third-party vendor risk register and due-diligence workflow
• •Incident response plan, tabletop history, and escalation paths

Out of Scope

• •Application-level penetration testing
• •Cloud configuration and posture review
• •Physical security controls

Findings

The following findings are ordered by business impact, not by remediation effort.

1. Vendor Risk Register Is Incomplete

Approximately 40% of active vendors lack a current security questionnaire on file. Several critical vendors have not been re-reviewed in over 18 months.

The vendor list was reconciled against the AP system on November 4, 2025. Numbers may shift slightly as procurement completes its quarterly close.

2. Incident Response Plan Is Untested

A written IR plan exists but has not been exercised in the last 12 months. Escalation contacts include two former employees.

Warning: Stale escalation contacts pose a material risk during an active incident. Recommend updating within 30 days.

3. Board Reporting Lacks Quantitative Anchors

Current board updates are qualitative. Leadership has expressed interest in a small, stable set of metrics that can be tracked quarter over quarter.

Recommended Metrics

The following metrics are intentionally minimal. The goal is a reporting set the board can absorb in under five minutes.

Prioritized Roadmap

1. Refresh vendor risk register and re-baseline questionnaires for top 25 vendors.
2. Update incident response plan; remove stale contacts; schedule a tabletop exercise.
3. Stand up the quarterly board metrics package above.
4. Revisit endpoint patch cadence and identity recertification at the next review.

Illustrative Reporting Snippet

Q4 2025 — Security Posture Summary
- Vendor questionnaires current: 78% (target 95%)
- Mean time to patch (critical): 11 days (target 7)
- IR tabletop exercises completed YTD: 0 (target 2)

Closing

The organization is well positioned to close the gaps identified in this memo within two quarters. Frontier IT Security is available to support the vendor refresh and the first tabletop exercise on a fixed-scope basis.