What is botium-toys-security-audit?

This repository is not software. It is a written security audit and risk assessment for a fictional or case study company called Botium Toys, a U.S. toy retailer that is expanding its online sales internationally. The document reviews the company's overall security setup and checks it against well known standards, including the NIST Cybersecurity Framework, PCI DSS for payment card handling, GDPR for European customer data, and SOC standards for data integrity and availability. The audit gives Botium Toys an elevated risk score of eight out of ten. The report explains what was covered, including internal IT equipment, on-site hardware, the company's online store systems, and older tools used to retain data. It lists both strengths and weaknesses. On the positive side, the company has a working firewall, managed antivirus software, physical security measures like locks and cameras, and a policy to notify European regulators within seventy-two hours of a data breach. On the negative side, the audit found weak password rules, no central way to manage passwords, no system in place to detect intrusions, and no backup or disaster recovery plan. A compliance checklist walks through specific gaps. The company does not separate employee access by role, meaning everyone can reach sensitive stored data and cardholder information. Customer credit card numbers are stored locally without encryption. Against PCI DSS rules, this makes the company non-compliant. For GDPR, the company is only partly compliant, since it has a breach notification plan but has not encrypted or properly sorted personal data belonging to EU customers. For SOC standards, the company keeps its data accurate and available but still lacks proper access control policies. The report closes with four recommendations: set up role-based access control so employees only reach the data they need, encrypt stored data and data sent over networks, build an automatic off-site backup system with a documented recovery plan, and install a network monitoring system to catch unusual activity. This is a useful reference for anyone studying how a cybersecurity audit is structured and written, such as students, career changers, or PMs who want to see what a compliance review looks like in practice.