CYB 1200 Module 4 Sample Paper

Baseline Security Controls for Riverbend Supply Company: Naming the Threats and Matching the Defenses

[Student Name]

Thomas Edison State University

CYB-1200: Introduction to Cybersecurity

Module 4 Written Assignment

Mentor: [Mentor Name]

June 14, 2026

What this page is doingThe title block names the company and the work the paper does, so a reader knows the scenario before the first line of prose. The module line uses the wording students actually type when they search, which keeps the document honest about what it is: an original model paper written for a sample library, not a submitted student assignment and not an official course document. Graders reward a title that could belong to no other paper, and a generic label such as Security Paper gives them nothing to reward.

Riverbend Supply Company and the Records It Depends On

Riverbend Supply Company is a composite wholesale distributor of plumbing and heating parts with 42 employees working from three sites in one state: a main warehouse and office with 26 staff, and two counter branches with 8 employees each. The company sells to licensed contractors rather than to the public, and roughly 1,800 accounts are active in a given year. There is no internal technology staff. A contracted technician provides about 24 hours of support a month, and the annual technology budget line is $18,000, of which about $4,000 is not already committed to licenses and hardware replacement.

Four groups of records matter most. Customer files hold business names, addresses, contact emails, purchase history, and payment terms for those 1,800 accounts. The point of sale systems at the two counters process about 1,100 card transactions a month between them. Payroll and personnel files hold Social Security numbers and direct deposit details for all 42 employees. Email is the fourth and least obvious record, because every purchase order, price quote, and payment instruction the company issues lives there. Ranking these by the cost of losing them, rather than by the cost of the equipment that stores them, is what makes the later control choices defensible.

The current position is ordinary for a company of this size. Passwords are set when someone is hired and are rarely changed. Each counter shares one login so that anyone at the desk can ring a sale. Backups run overnight to an external drive that stays plugged into the file server. The email service supports multifactor sign in, but it has not been turned on. The two outside sales laptops are not encrypted, and patches are applied when something stops working. Read against the functions of the NIST Cybersecurity Framework 2.0, the company has partial coverage of Protect and almost nothing under Detect, Respond, or Recover (National Institute of Standards and Technology, 2024).

What this page is doingNotice the order. The records come before the threats, and the ranking sentence states the logic the rest of the paper runs on. Rubrics in an introductory course reward a scenario with real detail, so the section carries counts a reader can hold: 42 employees, three sites, 1,800 accounts, 1,100 card transactions a month, $18,000 with $4,000 free. The plain description of the current position does quiet work too, because every later control answers something named here rather than arriving from a product catalog.

Threats This Company Is Most Likely to Face

The most probable threat is a fraudulent payment request arriving by email. In the common pattern, a message that appears to come from a known vendor or from an owner asks accounts payable to update bank details or to release a wire before the end of the day. Nothing is broken into; the message simply looks right. Business email compromise is repeatedly reported as one of the costliest categories of cybercrime, and industry breach reporting continues to find a human element in most incidents (Verizon, 2024). Six people at Riverbend can release a payment, and email is the ordering channel, so the exposure is real rather than theoretical.

Ransomware is the second threat, and it is best described by its consequence rather than its mechanics. Files the business needs become unreadable, order entry stops, and the counters fall back to paper while the warehouse cannot confirm stock. The specific weakness at Riverbend is the backup drive that stays connected to the file server, because anything that can reach the server can reach the backup on the same connection. With about $46,000 of orders written across the three sites on a normal business day, even a three day outage costs more than the entire annual technology budget.

Two quieter threats round out the picture. Shared counter logins mean that if a sale is voided or a price file is altered, no record shows which person did it, and a departing employee keeps knowledge of a password the badge return does not cancel. Reused passwords carry the same problem outward, since a password exposed in an unrelated breach may still open the company email. Ordinary error belongs on the list as well. An unencrypted laptop left in a truck is a disclosure of the customer list it holds, and a payroll file sent to the wrong address is a reportable event even though no attacker was involved.

What this page is doingEach threat is written by its consequence for this company, not by the method an attacker would use, which is what an introductory security paper should do. The connected backup drive is named as a specific weakness rather than left as general advice, and the $46,000 of daily orders turns an abstract downtime worry into a number the reader can set against the budget. Including ordinary human error alongside the two headline threats shows range and keeps the analysis from becoming a movie plot.

Controls Selected and the Reason Each One Helps

Multifactor sign in on company email and on any remote access is the first control, and it is already included in the subscription the company pays for. Multifactor authentication earns that position because it is the only control on this list that reduces three of the named threats at once. A password that is guessed, reused, or handed over in a convincing message stops being sufficient on its own, which blunts fraudulent payment requests, credential reuse, and the risk that a stolen laptop opens a live mailbox. Federal identity guidance treats a second factor as the baseline for accounts holding anything of value, and application based factors are stronger than codes sent by text (Grassi et al., 2017).

The second control changes the backup rather than adding a product. One copy stays where it is for fast restores, and a second copy is kept where the file server account cannot reach or delete it, either offline or held by the backup provider. The leverage in a ransomware incident is the absence of a copy the company can actually use, so a copy that survives the incident removes most of that leverage. A restore is then tested twice a year, with the recovered file opened and the elapsed time recorded, because a backup never restored is a hope rather than a control (Cybersecurity and Infrastructure Security Agency & Multi-State Information Sharing and Analysis Center, 2023).

Third, each person at the counters receives a named account and the shared logins are retired. Named accounts make it possible to answer who voided the sale or changed the price file, and they let a departure remove one account instead of forcing a password change that everyone must be told. Alongside this, day to day accounts lose local administrator rights, and the two owners keep separate administrator accounts used only when needed. Small businesses are advised to limit access to what each role requires, which keeps one compromised sign in from reaching payroll and customer files at the same time (Paulsen & Toth, 2016).

The last group addresses what technology alone does not stop. A short training session twice a year, paired with one written rule that any change to vendor bank details is confirmed by calling a number already on file, answers the fraudulent payment request directly. Full disk encryption is turned on for the two sales laptops so that a lost device is a hardware loss and not a disclosure. A monthly patching date is set for the server and the counter systems, and a one page contact sheet lists who is called, in what order, when something looks wrong. These steps track the baseline goals published for small organizations by the Cybersecurity and Infrastructure Security Agency (2023).

What this page is doingThis is the section where an introductory paper is won or lost. Every control is stated with the threat it answers in the same breath, so nothing reads as a wish list, and each choice is anchored to a public source rather than to opinion. The multifactor paragraph explains why that item is first, which is a stronger move than listing it first and hoping the reader notices. The writing stays defensive and explanatory throughout, describing what protects the company rather than how an attack would be carried out.

Priorities, Cost, and What Would Count as Success

Sequencing matters when about $4,000 is uncommitted. Multifactor sign in is turned on first because it costs nothing beyond the hours to enable it and to help 42 people register a factor. The second copy of the backup follows at an illustrative $540 a year. Disk encryption uses the capability already present in the operating system the laptops run. A training subscription for 42 seats is budgeted at roughly $1,080 a year, leaving about $2,300 for patch labor and for the technician time the first restore test will consume. These figures are illustrative for the composite company and are not quoted prices.

Success needs to be visible, so four plain measures are proposed. Every company email account carries a second factor within 60 days, counted as a percentage of active accounts. The accounting database is restored from the protected copy and opened successfully in under four hours, with the date and elapsed time recorded. Zero shared logins remain at either counter after 30 days. The share of staff who click a simulated fraudulent message is tracked across two rounds over six months, and the second round is compared with the first rather than judged against an outside benchmark.

None of this makes the company secure in an absolute sense, and saying so plainly is part of the analysis. A 42 person distributor will not run a monitoring center, and it will not detect a patient attacker quickly. What this baseline does is remove the failures that are common, cheap to prevent, and expensive to survive. A baseline is judged by whether the company can restore its own data and prove who logged in, not by how many products it has bought. The governance step is the one most often skipped: one named owner reviews this short list twice a year and reports what changed, which keeps a control set from quietly expiring.

What this page is doingCost, sequence, and measurement turn a description into a recommendation someone could act on, and the measures are written so a reader could check them: a percentage, an elapsed time, a count, and a trend across two rounds. Naming the illustrative figures as illustrative keeps the paper from claiming prices it cannot support. The closing admission of limits reads as judgment rather than hedging, because it is followed by the one governance step that keeps the short list alive.

References

Cybersecurity and Infrastructure Security Agency. (2023). Cross-sector cybersecurity performance goals (Version 1.0.1). U.S. Department of Homeland Security. https://www.cisa.gov/cross-sector-cybersecurity-performance-goals

Cybersecurity and Infrastructure Security Agency, & Multi-State Information Sharing and Analysis Center. (2023). #StopRansomware guide. U.S. Department of Homeland Security. https://www.cisa.gov/stopransomware

Grassi, P. A., Garcia, M. E., & Fenton, J. L. (2017). Digital identity guidelines (NIST Special Publication 800-63-3). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-63-3

National Institute of Standards and Technology. (2024). The NIST Cybersecurity Framework (CSF) 2.0 (NIST CSWP 29). U.S. Department of Commerce. https://doi.org/10.6028/NIST.CSWP.29

Paulsen, C., & Toth, P. (2016). Small business information security: The fundamentals (NISTIR 7621 Rev. 1). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.IR.7621r1

Verizon. (2024). 2024 data breach investigations report. https://www.verizon.com/business/resources/reports/dbir/

How this CYB 1200 Module 4 example is structured

No deliverable name is published for each module of this 1000 level course, so this CYB 1200 Module 4 example is written as the genre the module most commonly calls for: in many sections this module asks for a short written assignment that profiles an organization, names the threats it faces, and defends a set of controls; your course instructions and rubric decide the exact form. The paper opens with the company and the records it depends on, because a control only makes sense once the reader knows what is being protected. Threats come next, described in plain terms and tied to the records named above them. Controls follow, each paired with the reason it answers a named threat rather than arriving as a generic list. The closing section sets priorities inside a real budget line and states what success would look like.

CYB-1200 Module 4 questions, answered

What does CYB 1200 Module 4 usually ask for?

No deliverable name is published for individual modules, so treat this as the likely genre rather than a fixed title. In many sections this module asks for a short written assignment that describes an organization, names the threats it realistically faces, and justifies a small set of controls. Your course instructions and the rubric decide the exact form and length.

How many sources belong in an introductory cybersecurity paper?

The rubric for your section decides, but four to six is a reasonable range at this level. This example cites six: framework and baseline guidance from federal agencies, federal identity guidance, small business security fundamentals, and one industry breach report for figures. Agency publications are easy for a mentor to verify, which matters more than the number of entries.

Should I write about my own employer or build a composite company?

A composite is the safer choice. Writing about a current employer can expose real weaknesses in a document that will be uploaded and shared, and it limits what you are free to say. A composite of the right size lets you set the numbers the analysis needs, such as staff count, sites, and budget, while keeping the discussion defensive and general rather than operational.

Write yours, or have the desk draft it

This paper is an original model document written by our desk, not a submitted student paper and not an official Thomas Edison State University document. Read it for the moves, then write your own to the instructions in your classroom. If you want one built to your exact prompt and rubric, the first custom sample is free and arrives in 24 to 48 hours.

CYB 1200 Module 4: sample paper, in real form