Lumora Security
Essential Security Review
Report date
5 March 2026
NovaPay Financial
Essential Security Gap Assessment & NIST CSF 2.0 Mapping
industry
Fintech / Payments
Employee size
60 users / 65 mailboxes
Workspace
Microsoft 365
Devices
45 corporate + BYOD mobile
Data sensitivity
CRITICAL
Regulatory exposure
UAE CBUAE, DFSA, PCI DSS, GDPR
Essential controls: where things stand
5
Protected
5
Partially covered
7
Not protected
Already good at
✓
MFA enforced across all users
Microsoft Entra ID MFA is active and enforced for the full tenant. A solid foundation for identity security.
✓
Microsoft Defender for email
Defender for Office 365 is active and providing baseline phishing and malware protection across mailboxes.
✓
Cloudflare WAF in place
Web application firewall is active on the payment portal, providing solid protection at the perimeter.
✓
Firewall operational
Perimeter firewall is active and managing inbound/outbound traffic with basic rule governance.
✓
Endpoint protection on corporate devices
Antivirus is active on all corporate Windows and Mac machines, covering the core fleet.
Key improvement areas
1
No data loss prevention
Payment data, card details, and customer financial records can leave the environment with no controls or alerts in place.
2
No SSO across cloud apps
Staff hold separate credentials for every payment and SaaS tool, increasing credential sprawl and phishing exposure.
3
No incident response plan
No written playbook for the first 24 hours of a breach or fraud event. CBUAE notification timelines are at risk.
4
Admin accounts not separated
Staff who manage payment infrastructure use the same account for daily email and browsing. One compromise reaches everything.
5
No basic security monitoring
Nobody is watching for signs of intrusion. An attacker could be inside the environment for weeks before anyone notices.
Recommended budget
Estimated total annual investment to close the essential gaps identified in this review. Scoped to a 60-user fintech, covering licensing, deployment, and light managed support — no enterprise SOC or compliance build-out included.
Estimated annual investment
$18,000 – $27,000
/ year
Covers SSO, DLP, Defender upgrade, MDM, DMARC enforcement, phishing training, and Lumora's essential monitoring & support package.
NIST CSF 2.0 posture by function
Current security tools in place
Microsoft Defender for O365
Email security (active, Plan 1)
Microsoft Entra ID MFA
Enforced, SSO not yet configured
DMARC / SPF / DKIM
Configured, not at p=reject
Cloudflare WAF
Payment portal protection
Perimeter Firewall
Active, basic rule set
Cloud Backup
Active, recovery untested
Endpoint Antivirus
Windows/Mac corporate devices
Mobile Devices
No MDM or remote wipe
1
Essential security gap findings
2
NIST CSF 2.0 compliance mapping
3
Three-vector compliance model
People
Awareness training, phishing simulations, a clear reporting process, and written rules for passwords and devices.
Device
Knowing what's connected, keeping it patched, and making sure it's actually managed, not just trusted.
Application
Controls that protect payment platforms, banking APIs, SaaS tools, and data flows at the software layer.
4
Essential security roadmap
Quick wins
0 - 30 days: no major spend, immediate risk reduction
People
Define & communicate a one-line incident reporting path
Access
Separate admin accounts from daily-use accounts (no new tooling)
Data
Run a backup recovery test; document the real RPO/RTO
Visibility
Draft a one-page incident response plan and walk it through with leadership
PowerDMARC: begin enforcement journey toward project
Next 90 days
Deploy the essential tooling stack
Access
Microsoft Entra ID P2:SSO + Conditional Access rollout
Upgrade Microsoft Defender for O365 to Plan 2
Data
Microsoft Purview DLP: classification & policies for payment data
Devices
Microsoft Intune MDM: enrol mobile devices, enforce compliance
People
Sophos Phish Threat: first phishing simulation + ongoing micro-training
Access
Establish a quarterly vendor/third-party access review cadence
Visibility
Activate Lumora essential monitoring & support package
Visibility
Run a first light-touch vulnerability scan
Disclaimer: This Essential Security Review is based on information provided during the assessment intake and a structured discussion with your team. It is not a formal certification, penetration test, or compliance audit. The NIST CSF 2.0 mapping in this report is provided to show how essential controls relate to a recognised framework; it is indicative, not a certified compliance assessment. Findings and recommendations should be validated with a detailed technical assessment before implementation. Budget estimates are approximate and may vary based on scope, licensing, and vendor pricing at the time of procurement. This report is confidential and intended solely for the named organisation.
Book my review slot
