Rainbow Byte Bakery had no documented information security program. Customer payment data, employee records, and operational systems were operating without any formal controls, ownership, or oversight. Charlene's first task was to establish a compliance baseline using ISO 27001 Annex A as the primary framework, cross-referenced with NIST 800-53, to identify what controls existed (often informally), which were completely missing, and who should own each domain going forward. The output: a 1-page compliance summary suitable for leadership review and a foundation for every subsequent GRC project.

This project establishes the GRC program foundation using two complementary frameworks:

ISO 27001 provides the control library; NIST 800-53 provides the depth of implementation guidance. Together they ensure the compliance program is both internationally recognized and U.S. government-aligned — valuable when pursuing future customer contracts or certifications.

• 1

  Stakeholder kick-off meeting — Charlene met with the CTO, Office Manager, and head of E-Commerce to explain the compliance initiative and assign domain ownership.

• 2

  ISO 27001 Annex A walkthrough — All 114 controls reviewed and rated: Implemented, Partial, or Missing, based on interviews and system observation.

• 3

  Gap analysis documented — Gaps prioritized by risk impact; high-priority gaps flagged for immediate remediation planning.

• 4

  Control owners assigned — Each Annex A domain mapped to a named employee or role, establishing accountability.

• 5

  1-page compliance summary produced — Executive-ready summary presented to leadership with a 90-day remediation roadmap.

A regional bakery chain experienced a point-of-sale breach that exposed 18,000 customer credit card numbers. Rainbow Byte Bakery's CTO forwarded the news article to Charlene with one question: "Could this happen to us?" The answer was: yes, possibly. Charlene was tasked with building the bakery's first formal risk register — identifying threats, scoring likelihood and impact, determining residual risk after existing controls, and presenting the top 3 risks to leadership in a concise Risk Summary Report.

ISO 31000 provides the process-oriented risk management methodology (context → identification → analysis → evaluation → treatment). NIST RMF provides the federal-aligned categorization framework. Together they ensure the risk register is both business-friendly and auditor-ready.

• 1

  Risk identification workshop — 90-minute session with CTO, Office Manager, and E-Commerce lead to brainstorm threats across each operational area.

• 2

  5×5 likelihood-impact matrix applied — Each risk scored independently by Charlene and one department head; scores averaged for objectivity.

• 3

  Existing controls documented — What was already in place (even informally) was captured to calculate residual risk.

• 4

  Heat map visualized — Color-coded 5×5 matrix shared at the next leadership meeting, making risk immediately understandable to non-technical stakeholders.

• 5

  Top 3 Risk Summary Report — RR-001, RR-002, and RR-003 written up with recommended treatment options: mitigate, transfer, accept, or avoid.

Rainbow Byte Bakery relies on 12 external vendors — from Sprinkle Pay (payment processing) and CloudDough (e-commerce hosting) to FrostFlour Co. (ingredient supplier with procurement portal access). None had ever been formally assessed for security practices. Charlene designed a 25-question Vendor Security Questionnaire spanning five risk domains and piloted it on Sprinkle Pay, the highest-risk vendor due to their direct access to payment data. The result: a scored Vendor Risk Scorecard and a formal vendor risk tiering system for ongoing management.

Third-party risk is one of the most underestimated areas in small business security. ISO 27001 Clause A.15 mandates that supplier agreements include security requirements. NIST SP 800-161 (C-SCRM) provides a supply chain risk management framework that scales to bakery-size organizations as much as enterprise ones.

• 1

  Vendor inventory compiled — All 12 vendors catalogued with their access type, data touched, and initial risk tier (Critical, High, Medium, Low).

• 2

  25-question questionnaire designed — Five domains, five questions each. Questions ranged from "Do you enforce MFA on privileged accounts?" to "What is your breach notification timeline?"

• 3

  Questionnaire sent to Sprinkle Pay — Responses received within 10 business days; supplemented with review of their publicly available SOC 2 summary.

• 4

  Scorecard calculated and reviewed — Scores entered into a weighted scoring matrix; findings reviewed with the CTO and Operations Director.

• 5

  Remediation request issued — Charlene sent Sprinkle Pay a formal written request for their incident notification SLA and MFA enforcement timeline.

The bakery's Office Manager, Tamika, received a convincing phishing email purportedly from the payroll platform ButterBucks HR at the Color Castle headquarters. She clicked the link before realizing it was fake — fortunately catching herself before entering credentials. The CTO was shaken. Charlene recognized this wasn't just a close call; it was evidence that the bakery had no formal procedure for detecting, containing, or recovering from a cyberincident. She wrote a complete Incident Response Plan aligned to ISO 27035 and NIST guidelines, then ran a tabletop simulation with the CTO, Office Manager, and E-Commerce lead to test the plan before a real incident forced the issue.

ISO 27035 provides a five-stage incident management process that maps cleanly onto the bakery's operational capacity. NIST SP 800-61 Rev 2 provides detailed technical guidance for each phase and forms the basis of the IR Plan document template used.

• 1

  Near-miss documented — Tamika's phishing encounter formally documented as a security incident (even without a breach) to establish incident recording precedent.

• 2

  IR Plan drafted — 8-page plan written covering Purpose, Scope, Roles & Responsibilities, all six phases, escalation contacts, and communication templates.

• 3

  Tabletop scenario designed — Phishing → credential theft → payroll access scenario built with decision points, inject cards, and timed phases.

• 4

  Tabletop exercise run — 90-minute session with CTO, Office Manager, and E-Commerce lead. Three major process gaps identified in real time.

• 5

  Formal Incident Report Template produced — Standardized report form for any future incidents: timeline, severity, systems affected, containment actions, root cause, and lessons learned.

Rainbow Byte Bakery's e-commerce platform — built on AWS — processes customer orders, stores email addresses, and handles payment redirects through Sprinkle Pay. A prospective wholesale grocery partner requested a copy of the bakery's SOC 2 report before signing a supply agreement. The bakery had none. Charlene used the AWS Free Tier environment to map SOC 2 Trust Service Criteria CC1 through CC9 to the actual cloud configuration, identifying what was compliant, what was not, and gathering screenshots as mock audit evidence to lay the groundwork for a future formal SOC 2 audit engagement.

SOC 2 is the most common compliance certification requested by B2B SaaS and e-commerce companies. It aligns closely with NIST 800-53 access control and audit families. This mapping positions Rainbow Byte Bakery to engage a formal SOC 2 auditor within 12–18 months once remediations are complete.

• 1

  AWS environment reviewed — Charlene walked through IAM, S3, CloudTrail, CloudWatch, and Config using the AWS Console to document the current state.

• 2

  SOC 2 criteria mapped — Each of CC1–CC9 mapped to the specific AWS service or feature that satisfies it, and rated against actual configuration.

• 3

  MFA enabled on all IAM accounts — Charlene enabled MFA for root and all admin IAM accounts immediately upon identifying this critical gap.

• 4

  CloudTrail logging enabled — Audit trail logging activated across all regions; logs directed to a dedicated S3 bucket with restricted access.

• 5

  Evidence package assembled — Screenshots, exported policies, and configuration outputs organized into a mock evidence binder by CC criterion.

After completing five projects, Charlene had a risk register, a vendor scorecard, a control matrix, and an IR plan — but no unified view that leadership could review at a glance. The bakery's quarterly board meeting was three weeks away and the CEO wanted a simple, visual answer to the question: "Are we secure and compliant?" Charlene built a compliance dashboard in Excel translating all prior project data into visual metrics: control implementation rates, open risk count by severity, remediation progress, and vendor risk status. The dashboard became the standing GRC report format for all future leadership reviews.

NIST 800-53 PM-6 requires organizations to develop, monitor, and report on information security measures of performance. The compliance dashboard directly satisfies this control while also supporting the NIST CSF's continuous monitoring expectation across all five functions: Identify, Protect, Detect, Respond, and Recover.

• 1

  Metrics inventory — All data outputs from Projects 1–5 catalogued to identify what could be tracked over time.

• 2

  KPI framework defined — Each metric given a name, data source, target value, and owner — reviewed and approved by the CTO before dashboard build.

• 3

  Excel dashboard built — Color-coded tables, conditional formatting, and simple bar/donut charts created for non-technical leadership consumption.

• 4

  Presented to board — Dashboard shared at quarterly meeting; CTO approved it as the standing GRC report format going forward.

• 5

  Update cadence established — Monthly data refresh process documented and assigned to Charlene; quarterly narrative summary added for board distribution.

After completing six individual GRC projects, Charlene's final challenge was to step back and evaluate the entire program she'd built. The Mock Internal Audit is a structured self-assessment using ISO 19011 audit methodology — selecting 10 key controls from across Projects 1–6, gathering supporting evidence, completing a formal Internal Audit Checklist, and producing a 2-page Audit Report. The report identifies non-conformities (areas where stated controls don't match actual practice), presents corrective actions, and provides leadership with an honest assessment of where Rainbow Byte Bakery's GRC program stands today vs. where it needs to be.

ISO 19011 is the international standard for auditing management systems — it defines the principles of auditing, managing an audit program, and conducting and reporting audits. NIST CA-2 requires periodic control assessments to validate whether controls are effectively implemented. This project satisfies both, producing a formal audit record and a corrective action plan (analogous to a NIST Plan of Action and Milestones — POA&M).

• 1

  Audit scope defined — 10 controls selected to span all six prior projects, prioritizing the highest-risk areas identified in the risk register.

• 2

  Evidence gathered — Each control's evidence collected: screenshots, documents, timestamps, and system exports where applicable.

• 3

  Audit checklist completed — Each control rated: Conforming, Minor Non-Conformity, or Major Non-Conformity, with objective evidence documented for each finding.

• 4

  Non-conformities analyzed — 3 Major NCs (vendor assessments, security training, backup testing) and 4 Minor NCs identified with root cause analysis for each.

• 5

  Audit Report written and submitted — Formal 2-page report presented to the CTO and CEO, including a prioritized corrective action plan with owners and due dates.