Example: a one-page security action plan
The page QoBot writes for a small business after the first conversation: what to do this month and this quarter, who does it, how long it takes and what it costs. The company is fictional; the format is the one QoBot uses.
What you’re looking at
Brightwater Foods is a fictional food distributor in Cork, Ireland: 31 people, Microsoft 365, an IT provider who comes once a month, supplier invoices paid by bank transfer. Aoife, the managing director, spent 15 minutes answering QoBot’s questions. This is the page QoBot wrote next.
Every action names one person, says why it matters in one line, and gives the time and the cost. Costs are estimates; QoBot never presents them as quotes.
The plan
Brightwater Foods: security action plan
For Aoife Byrne, managing director · Date 20 October 2026 · Prepared by QoBot, after the conversation of 13 October
What changed: first plan. The insurer’s renewal form, due 15 November, asks about multi-factor authentication: that action comes first.
Now: this month
| # | Action | Why | Who | Time | Cost (estimate) |
|---|---|---|---|---|---|
| 1 | Turn on a second sign-in step (a code on the phone) for the 9 Microsoft 365 accounts without it, the 2 admin accounts first | One stolen password opens a mailbox today; the insurer asks | Declan (IT provider); Niamh sends the team email | ½ day | €0, included in your licence |
| 2 | Before any change of supplier bank details: call back on a known number, and a second person approves | A fake bank-details email reached accounts in September | Niamh (accounts); Aoife approves | 1 h to set up | €0 |
| 3 | Close the remote desktop access open on the office router | A common way in for ransomware | Declan | 1 h | €0 |
Next: by January
| # | Action | Why | Who | Time | Cost (estimate) |
|---|---|---|---|---|---|
| 4 | Restore one folder from the server backup to prove it works, then keep a weekly copy on a disk stored offline | Backups run every night but have never been restored | Declan | ½ day | €160–400 for 2 rotating disks |
| 5 | Close the 2 accounts of former employees; review accounts each month | One still receives customer emails | Declan | 30 min | €0, 2 licences saved |
| 6 | Publish the DMARC record for brightwater-foods.ie: observe 3 weeks, then reject | Anyone can send email in your name today | Declan | 1 h, check in 3 weeks | €0 |
| 7 | 20 minutes with the team: fake emails, and who to tell | Two phishing emails reported since the summer | Aoife, with QoBot’s slides | 20 min | €0 |
Later
Replace the 2 PCs that can’t run a supported version of Windows (€1,400–2,800). Check that disk encryption is on for the 9 laptops.
Totals (estimate)
- Now: €0 to buy; about 3 hours of Declan’s time, one visit.
- Next: €160–400 one-off; about 1 day of Declan’s time.
- Estimates, excl. VAT: confirm with a quote.
Deferred or accepted
None.
Example of a deliverable: fictional company. Written in QoBot's action plan format · qobot.io
What happens next
QoBot sends Declan the exact steps for actions 1, 3 and 5, written for Microsoft 365 and the office router, and drafts Niamh’s email to the team. On Friday it asks who has done what, notes how each action was checked (a screenshot, a test, or someone’s word, labelled as such) and moves the rest. The next plan is a new dated page, with what changed and why.
FAQ
Is this a real company?
No. Brightwater Foods, its people and its figures are invented. The structure, the order of the actions and the cost ranges follow the rules QoBot uses for a real plan.
Why only seven actions?
A 31-person company does three things a month, not ten. QoBot ranks the actions by risk removed per hour spent, and keeps the rest for later.
Are the costs quotes?
No. They are estimates, labelled as such, from QoBot's working ranges. When your IT provider sends a real quote, QoBot records it in place of the estimate.
Sources
- Regulation (EU) 2016/679 (GDPR), article 32EUR-Lex · security appropriate to the riskOfficial text
- NCSC: email security and anti-spoofingUK National Cyber Security Centre · SPF, DKIM and DMARC (action 6)Official page
This page explains the rules in plain words. It isn't legal advice: for a borderline case, ask a lawyer. Report an error