Skip to content
HUMANWALL

Mission 29

The 90-Day HUMANWALL Cybersecurity Implementation Roadmap

Awareness becomes resilience when it turns into a plan. This mission gives you a practical 90-day roadmap in three phases, with an owner and simple evidence for every action, so a small business can make real progress without being overwhelmed.

15 minutesHUMANWALL ChampionJump to scenario & quiz ↓

In this mission you will

  • Describe the three phases of the 90-day HUMANWALL roadmap and what each one achieves.
  • Prioritise security gaps by impact, exposure, urgency and dependencies when capacity is limited.
  • Assign an owner, due date and simple evidence to each roadmap action.
  • Recognise when a high-impact risk must be escalated immediately instead of waiting for its phase.

Why 90 days

Most small businesses do not fail at security because they lack ideas. They fail because good intentions never become dated actions with owners. Ninety days is long enough to make visible progress and short enough to keep attention. The roadmap is split into three phases of about 30 days: discover and fix quick wins, strengthen controls, then test and reassess. Each action needs three things: a named owner, a due date and simple evidence that it happened.

Days 1–30: Discover and secure quick wins

  • Name one accountable owner for cybersecurity, with the support of the business owner or director.
  • Build a simple asset list: key devices, email and cloud accounts, banking access, important systems and where important data lives.
  • Turn on multi-factor authentication (MFA) for email, banking and admin accounts first.
  • Back up the most important data, with at least one copy that ransomware cannot reach.
  • Set up one clear reporting channel for anything suspicious, and an incident contact card.
  • Record urgent risks you find so none are forgotten.

Days 31–60: Strengthen controls and write short policies

  • Apply updates to the most exposed devices and remove unknown or unlicensed software.
  • Review vendor and SaaS access: who can get into your systems or data, and is it still needed?
  • Remove leavers’ accounts and shared logins; limit admin rights.
  • Publish short, one-page procedures: payment verification, acceptable use, AI use, reporting and backups.
  • Run short role-based awareness sessions: accounts on payment fraud, front desk on impersonation, managers on approvals.

Days 61–90: Test, verify and reassess

  • Do a real restore test of one important system and record how long it took.
  • Run a short tabletop exercise on a phishing or ransomware scenario with the people who would respond.
  • Check that earlier fixes actually hold: is MFA still on, are removed accounts really gone?
  • Reassess your posture and compare it with where you started.
  • Agree the plan for the next quarter, based on what you learnt.

How to prioritise when you cannot do everything

  1. 1List every gap you found in one place.
  2. 2For each gap, ask: how much harm if it is exploited (impact)? How easy is it for someone to reach (exposure)? Is it already being targeted or about to matter (urgency)?
  3. 3Check dependencies: some fixes need others first, such as an asset list before an access review.
  4. 4Pick the few actions with the highest impact and exposure that you can genuinely finish.
  5. 5For any high-impact gap you cannot fix yet, write down a temporary safeguard and have the owner accept the remaining risk in writing.

Owners and evidence keep it honest

Use a simple action tracker: risk, action, owner, due date, status, evidence and remaining risk. Evidence should be light and contain no secrets. Good examples are a screenshot of MFA settings with no codes visible, a dated restore-test note, a signed one-page policy or a short summary of the tabletop exercise. Review the tracker every two weeks for 15 minutes. If an action slips, ask what is blocking it rather than who is to blame.

Practical business example

Anand Auto Components finds 12 gaps

Anand Auto Components, a fictional 45-person parts supplier in Coimbatore, did a first review and found 12 gaps. The owner, Lakshmi, wanted to fix everything in a month. Her IT vendor, Suresh, warned that they had time for about four serious pieces of work. They ranked the gaps by impact and exposure. On day 9, they also found that a former sales manager still had access to the shared customer folder. That could not wait. Suresh removed it the same day and checked for other leavers. For the planned work, they chose MFA on email and banking, offline backups of the billing system, a vendor access review and a payment call-back rule. Each had an owner and a due date in a shared sheet. On day 80, they restored the billing data to a spare laptop and noted it took most of an afternoon. Lakshmi accepted the remaining gaps in writing and scheduled them for the next quarter.

The lesson: Lakshmi did not fix everything, and that was fine. She fixed the most important things, dealt with an urgent risk immediately, kept evidence and made a conscious decision about what came next.

Key takeaways

  • Split the 90 days into three phases: discover and fix quick wins, strengthen controls, then test and reassess.
  • Every action needs a named owner, a due date and light evidence with no secrets in it.
  • Prioritise by impact, exposure, urgency and dependencies, and be honest about capacity.
  • Urgent high-impact risks are escalated and handled now, not held back for their planned phase.
  • Gaps you cannot fix yet are recorded, given a temporary safeguard where possible, and knowingly accepted by the owner.

Scenario lab · +25 XP

Twelve gaps, capacity for four

You are the newly named security owner at Prakash Pharma Distributors, a fictional 35-person medicine distributor in Indore. After a first review you have 12 gaps. Your team and IT vendor can realistically complete about four pieces of work in the next 90 days. The owner, Mr Prakash, wants a plan by Friday.

Fictional scenario. Never enter real passwords, OTPs or customer details anywhere in this course.

Decision 1 of 3

How do you choose what goes into the first 30 days?

Knowledge check · +20 XP on mastery

Check your understanding

1. What should happen to a high-impact risk discovered on day 10 of the roadmap?
2. Which of these is the strongest evidence that the 90-day backup action is complete?
3. Which action belongs most naturally in Days 1–30?
4. An action is overdue in the tracker. What is the most helpful response?

Practical action · +40 XP (self-reported)

Build your 90-day action tracker

Create a simple tracker in a spreadsheet or notebook. Describe risks in general terms. Do not record passwords, account numbers, customer details or anything that would help an attacker.

  1. 1.Create columns: risk, action, phase (1–30, 31–60, 61–90), owner, due date, status, evidence and remaining risk.
  2. 2.Add the Days 1–30 basics: owner named, asset list, MFA on email and banking, protected backup and reporting channel.
  3. 3.Add two or three Days 31–60 actions, such as a vendor access review and short written procedures.
  4. 4.Add Days 61–90 actions: a real restore test, a tabletop exercise and a posture reassessment.
  5. 5.Mark any high-impact gap you already know about as urgent and agree with the owner what happens this week.
  6. 6.Book a 15-minute review every two weeks and a day-90 review to agree next quarter’s plan.

Do this in your own records. Don’t enter passwords, OTPs, customer data or incident details here.

Mission status: Not started

A mission is complete when you have read the lesson, answered the knowledge check and acknowledged the practical action. Mastery means scoring at least 3 of 4 on the knowledge check.

View my progress