Skillnaija All courses →

Personal & Small-Business Security Audit and Hardening Plan

The capstone project for Cybersecurity Foundations — a free Data & Tech course. Pass it and you earn a certificate anyone can verify.

Start the course free Download the project workbook

The project unlocks once you complete the lessons. The workbook is free to download now so you can see exactly what is expected.

What you will submit

A link to a Google Doc (set to 'anyone with the link can view') containing your completed audit (phone, accounts, and business or second device), a clear list of what you FOUND, exactly what you CHANGED (before/after), and your hardening plan with a timeline for the rest. Do NOT include any real passwords, OTPs, BVNs or account numbers in the document.

What to do, step by step

  1. Run a security audit of YOUR phone using a checklist drawn from the course: screen lock strength, Find My Device, app sources, app permissions (especially any with 'Accessibility'), automatic updates, automatic backup, and SIM PIN. For each item, write down what you found (your current state) — honestly, even where it's bad.
  2. Audit your most important ACCOUNTS the same way: list your email, bank/fintech, WhatsApp and main social accounts, and for each record whether the password is strong and unique, whether 2FA is on, and whether it's app-based or SMS. Note where you are reusing passwords or relying on SMS OTP that is vulnerable to SIM-swap (Lessons 3-5).
  3. If you run or help with any small business (even a WhatsApp store), audit it too: who has access to which accounts, where customer data is stored, what sensitive data you keep, and whether you follow the NDPA basics from Lesson 7 (collect only what you need, keep it secure, don't share/sell it). If you have no business, audit a second device (a laptop or a family member's phone with permission) instead.
  4. FIX what you reasonably can during the course and record exactly what you changed — for example: 'set up Bitwarden and changed my email and bank passwords to unique generated ones,' 'turned on app-based 2FA for email and Instagram and saved my backup codes,' 'enabled WhatsApp two-step verification,' 'turned on automatic backup.' Be specific about before and after.
  5. Write a short HARDENING PLAN: a clear list of what you found (the weaknesses), what you have already changed, and what you still plan to change with a realistic timeline (e.g. 'this week,' 'this month'). Include at least one thing you would do differently the next time a suspicious bank/WhatsApp message reaches you, applying the 'verify on a channel you choose' rule from Lesson 2.

Files to work with

Project workbook (fill in, then submit)The whole brief, an evidence checklist, the grading rubric as a self-check and the link-sharing steps in one file. Opens in Word, Google Docs or WPS.Word · 7 KB

How it is graded

CriterionWeight
Thoroughness of the audit — phone, key accounts, and a business/second device are all genuinely checked against the course checklist30%
Real fixes made — concrete changes actually carried out (password manager, 2FA, backups, locks) with honest before/after detail30%
Quality of the hardening plan — clear list of weaknesses found and a realistic, prioritised plan for what remains20%
Understanding of threats & safe practice — correctly applies phishing/SIM-swap/2FA/NDPA lessons and includes NO real secrets in the document20%

You need 65% overall to pass. A failed submission comes back with feedback and can be revised and resubmitted.

Before you submit: make your link public

If your work lives in Google Drive or Google Docs, open Share → General access and change “Restricted” to “Anyone with the link” (Viewer). Then paste the link into a private browser window: if it opens without sign-in, you are ready. A private link cannot be graded — it is the single most common reason a good project fails.

Frequently asked questions

Do I have to finish Cybersecurity Foundations before submitting the project?

Yes. The submission screen opens once every lesson in Cybersecurity Foundations is marked complete. The lessons are where the methods, the Nigerian context and the worked examples the project depends on are taught.

How is the project graded?

An examiner scores each rubric criterion from 0 to 100 and weights them as shown on this page; you need 65% overall to pass. Most submissions are graded within minutes and you get written feedback on what was strong and what to improve.

Can I resubmit if I fail?

Yes. A failed project comes back with feedback; revise the weak parts and resubmit. A passed project is final — the certificate is issued and cannot be re-rolled.

What do I actually submit?

A write-up of what you did (under 5,000 characters) plus a public link to your work — a Google Drive folder, Google Doc, spreadsheet, GitHub repository or video. The link must open without sign-in; a private link cannot be graded. The free project workbook on this page walks you through all 5 steps.

Is the certificate real?

Yes. Passing this project issues a certificate with a unique verification code. Anyone — an employer, a client, a school — can open the verification page and see that the certificate is genuine and which project earned it.

More Data & Tech projects

Ready to earn this certificate?

Cybersecurity Foundations is free and self-paced. Finish the lessons, complete this project, and the certificate is yours to share.

Start learning free