CapstoneLesson 1 of 3

Turning Point Training Institute

Capstone A: Your Personal Cybersecurity Audit

13 min readBeginner

Where you are: Capstone · 7.1 · About 60 minutes. This capstone brings together all six units of Dr. Al-Doori's Cyber Security Essentials and the 2026 updates you have studied, and closes the loop you opened in Lesson 0.2.

Privacy note: do this check privately on your own device. Never write down, share, upload or submit real passwords, recovery codes, MFA secrets or QR codes, account names, email addresses, phone numbers, home IP addresses, router credentials, screenshots of your accounts, or private messages. If anything is asked for, it is only a completion confirmation, redacted observations, a risk level and your action plan.

What you'll be able to do

You will audit your own accounts, devices and habits against current guidance, compare the result with your starting point, and turn what you find into a prioritised plan.

Re-run the starting-point self-check from Lesson 0.2 and measure how far you have come.
Audit eight areas of your personal security in more depth.
Write your top five actions, in the order that reduces the most risk first.

How this capstone works

Part	What you do	Time
1	Re-run the Lesson 0.2 self-check and compare it with your baseline	about 10 minutes
2	Deep audit of eight areas, using the scoring guide	about 35 minutes
3	Reflection and your top-five action plan	about 15 minutes

Everything happens on your own device, in private. Your notes contain only dates, counts, risk levels, redacted observations and actions — never account details. If you find something you can fix in two minutes (for example, an update waiting to install), fix it now and note that you did.

Part 1: Re-run your starting point

Run exactly the same checklist you used in Lesson 0.2. Review each item privately and note whether it is true for you today. The boxes on this page are for reading only and nothing is saved. If you are not sure, count it as not true.

1. Accounts

I know which of my accounts matter most (for example, my main email, banking and phone accounts).
My main email account has a password that I use nowhere else.
I do not reuse the same password across my important accounts.

2. Sign-in methods

I use a password manager (built into my phone or browser, or a separate app).
My main email account has a second sign-in step turned on (multi-factor authentication).
I know how I would get back into my main email if I lost my phone.

3. Updates

Automatic updates are turned on for my phone.
Automatic updates are turned on for my computer, and it still receives security updates.
I install app and browser updates when they are offered, rather than postponing them.

4. Backups

My important photos and files exist somewhere other than the device they are on.
At least one copy of them is not permanently connected to my device.
I have restored a file from a backup at least once, so I know it works.

5. Home Wi-Fi

My home Wi-Fi needs a password, and I know who has it.
I have changed the router's default admin password, or checked that it came with a unique one.
I know whether my router still receives updates.

6. Phone

My phone locks with a PIN, passcode or biometric.
I install apps only from the official app store.
I have checked which apps can use my location, camera and microphone.

7. Sharing habits

I have checked who can see my social media posts.
I never share one-time sign-in codes with anyone, even someone claiming to be from my bank.
Before acting on an unexpected request for money or codes, I check with the person or company another way.

Compare with your baseline

Use the same scale as Lesson 0.2: 0–1 true = high risk, 2 true = medium, 3 true = low. Copy this table into your private note and fill it in from your Lesson 0.2 record and today's counts.

Area	Baseline risk (Lesson 0.2)	Risk today	Moved?
1. Accounts
2. Sign-in methods
3. Updates
4. Backups
5. Home Wi-Fi
6. Phone
7. Sharing habits

If you no longer have your baseline, simply record today's results as your new starting point — that is still useful.

Part 2: The deep audit

The starting-point check measured basic habits. This audit goes one level deeper, using what each unit taught. Work through the eight areas below. Review each item privately and note whether it is true for you, then count how many of the three checks in each area are true and use the scoring guide that follows.

A. Sign-in methods (Lessons 4.5 and 4.6)

My main email and my password manager use the strongest sign-in option they offer — a passkey or security key where available, otherwise an authenticator app.
Where I have set up a stronger method, I have removed or reviewed weaker fallbacks such as SMS codes, if the service allows it.
I know never to approve a sign-in prompt that I did not start myself.

B. Password manager and reuse (Lessons 4.2 to 4.4)

My password manager's own password is a long passphrase I use nowhere else, and the manager has MFA turned on.
I have run my manager's password-health or breach report and fixed the reused or exposed passwords on my important accounts.
I change a password when there is a breach or a suspicion of compromise, not on a fixed calendar.

C. Recovery options (Lesson 4.7)

The recovery email and phone number on my main email account are current and belong to me.
Any recovery codes are stored somewhere safe (for example, in my password manager or printed and kept securely) — not in my notes for this audit.
Where a service forces security questions, my answers are random values stored in my password manager.

D. Device updates (Lesson 5.4)

Every phone, tablet and computer I use has automatic updates turned on.
None of my devices runs a system that no longer receives security updates (for example, Windows 10 support ended in October 2025).
My browser and apps are up to date today.

E. Backups, with a test restore (Lesson 5.5)

My important files follow the 3-2-1 idea: three copies, on two different kinds of storage, with one kept elsewhere.
At least one copy is disconnected from my devices most of the time, because ransomware attacks connected copies.
Today I restored one test file from my backup and opened it successfully.

F. Phone settings (Lesson 5.6)

My phone has a strong screen lock, installs updates automatically and only installs apps from the official store.
I have reviewed app permissions for location, camera and microphone and removed ones I don't need.
Lost-device controls (find and erase) are on, and I have added a PIN or similar protection to my mobile-carrier account if my carrier offers one.

G. Home router (Lesson 5.10)

The router's admin password is changed from the default (or was unique from the factory), and its Wi-Fi uses WPA3 or WPA2.
Firmware updates are installed (automatically if possible), and the router is still supported by its maker.
WPS, remote administration and features I don't use (such as UPnP) are turned off, and visitors use a guest network.

H. Public sharing (Lessons 3.4 and 3.5)

I have checked who can see my posts on each social platform I use, and limited public posts where I can.
I remove location from photos before sharing them, and I think twice before posting public voice or video clips.
My family or close contacts and I have agreed a way to verify urgent requests, such as a code word or calling back on a known number.

Scoring guide

For each area, count the true statements and give the area a risk level:

True statements in the area	Risk level	What it means
3	Low	Keep it up. Re-check once in a while, and after any big change such as a new phone.
2	Medium	One gap remains. It may belong in your top five.
0–1	High	Start here. This area is likely to appear in your top five.

Then read the whole picture:

Any high risk in A, B or C (sign-in, passwords, recovery) deserves priority. Your email account is the key that resets most others, so weaknesses here spread.
High risk in E (backups) means one ransomware attack, theft or broken device could cost you files you can never get back.
High risk in D, F or G means known, fixable weaknesses are left open on your devices or network.
High risk in H mainly affects how convincing scams against you or your family can be.

Part 3: Reflect, then plan

Reflection

Answer these privately, in two or three sentences each:

Which area moved most since Lesson 0.2, and what made the difference?
Which area is still your weakest, and why do you think it has been hard to fix?
Which single habit from this course do you think protects you most, and why?

Your top-five action plan

Choose five actions from your gaps. Put them in priority order using these rules:

Protect the master keys first: your main email, your password manager and your phone-carrier account.
Then stop the most likely harm: reused passwords, missing MFA and scams that ask for codes or money.
Then limit the damage if something still goes wrong: working backups and recovery options.
Then close the remaining doors: devices, router and sharing settings.
Make every action specific and dated: "Turn on a passkey for my main email by Sunday", not "improve my security".

Copy this table into your private note:

#	Action (specific)	Area	Why it matters	Done by
1
2
3
4
5

Your deliverable

If your course asks you to hand anything in, submit only these four things. Never submit passwords, recovery codes, MFA secrets, personal account details, private screenshots, router credentials, private messages or sensitive identifying data.

A completion confirmation — "I completed Parts 1, 2 and 3 privately on my own device."
Redacted observations — short notes with no names, addresses, numbers or screenshots.
Risk levels — your Part 1 comparison and your Part 2 risk level for each area.
Your top-five action plan.

What a redacted observation looks like:

Acceptable	Never submit
"Main email: passkey now on; SMS fallback still enabled — action #2."	The email address itself, or a screenshot of the security page
"Password manager report: several reused passwords on shopping sites — action #3."	Any password, or the manager's report itself
"Router: admin password changed; firmware status unknown — action #4."	The router's admin password, network name or home IP address
"Test restore of one document worked."	A screenshot of your files or folders

Self-assessment

Check your own work against this guide:

Criterion	Developing	Complete	Strong
Part 1 comparison	Some areas missing	All seven areas compared	All seven compared, with a note on what caused each change
Part 2 audit	Some areas skipped	All eight areas scored honestly	All eight scored, with at least one quick fix made during the audit
Backups	No test restore	Test restore done	Test restore done and a disconnected copy confirmed
Action plan	Vague actions	Five specific actions	Five specific, dated actions in a justified priority order
Privacy	Sensitive details included	Only allowed items recorded	Only allowed items, with every observation redacted

Key Takeaways

Security is relative and personal: measure where you are, fix the weakest areas first, and measure again.
Your email, your password manager and your phone-carrier account are master keys — protect them first.
A backup you have never restored is a hope, not a plan; the test restore is part of the audit.
An action plan works when each action is specific, dated and in priority order.
Your audit stays private: share only a completion confirmation, redacted observations, risk levels and your plan.

Sources

PreviousUnit VI Checkpoint: Preserve or Destroy?NextCapstone B: A Beginner Digital Forensics Case