Kosmo Team · IT Audit Report
Spreewald Logistik GmbH
Mock report · all data invented
Summary
Basic tools work, but legal gaps and untested backups put operations at risk
Score per area
Three areas need urgent action
Urgent below 40 · Improve 40–69 · Good 70+
Scope & method
Every finding is verified, not just self-reported
| Step | What we did | Time |
|---|---|---|
| Intake form | 52 questions, owner and office manager | ~45 min (you) |
| Kickoff interview | Processes, tools and pain points | 90 min |
| Remote checks | MFA, backup restore test, cookie scan, SPF/DKIM/DMARC, user accounts | 4 h |
| Analysis & report | Scoring, legal mapping, savings, review by 2 experts | 6 h |
| Results call | Walkthrough and Q&A | 60 min |
Scoping answers that decide which laws apply
| Question | Answer | Effect |
|---|---|---|
| Employees | 20–49 | Data Protection Officer required |
| Turnover | €2–10M | Must send e-invoices from 2027 |
| Sector | Transport | NIS2 sector, below size threshold |
| Customers | B2B | Accessibility act not triggered |
| Online presence | Website, no shop | Impressum, cookie consent |
| Sensitive data | Driver licences, health certificates | Extra protection, impact assessment |
| AI use | Staff use ChatGPT ad-hoc | AI literacy duty |
| Critical infrastructure | Supplies food retail chains | NIS2 supply-chain questions |
Laws & standards
Six laws apply; best practice follows five standards
Laws
Standards
Must fix · legal
Five legal gaps
Each can lead to fines or lost contracts.
No Data Protection Officer
Required at 20+ staff handling personal data.
Evidence: none named in privacy policy
No record of processing
Authorities can request it at any time.
Evidence: requested, none exists
4 processing agreements missing
Every provider handling your data needs one.
Evidence: dispatch tool, Dropbox, TeamViewer, newsletter
No AI rules or training
Customer data goes into ChatGPT without rules.
Evidence: 6 of 9 office staff use it
Cookie banner pre-ticked
Consent must be active; common warning-letter target.
Evidence: 3 trackers load before consent
Best practice
Gaps that cost time or raise risk
| Gap | Evidence | Reference |
|---|---|---|
| No MFA on email and cloud | 0 of 34 accounts | DIN SPEC 27076; CIS 6 |
| Backups never tested | Restore failed; last usable backup 5 weeks old | DIN SPEC 27076; BSI CON.3; CIS 11 |
| Shared dispatch login | 1 login, 7 people | BSI ORP.4; CIS 5 |
| No offboarding | 2 former drivers still active | BSI ORP.2; CIS 5 |
| Email domain unprotected | DMARC missing | BSI APP.5.3; CIS 9 |
| No tool training; workarounds persist | No onboarding; Excel lists in use | ISO/IEC 27001 A.6.3 |
| Orders typed into 3 systems | ~18 h/week | Efficiency |
| Contacts in Excel and Outlook | 3 separate lists | Efficiency |
| Delivery questions by phone | ~6 h/week | Efficiency |
Top risks
€80k+ at stake every year
Outage at €16.8k turnover per working day. Hours at €35, 46 weeks. Losing NIS2-bound retail contracts and GDPR fines come on top.
Tool spend
Cut 2 of 8 paid tools, save €2.9k a year
Roadmap
Fixed in 90 days
Days 1–30
You, no outside help- MFA on all accounts
- Close former staff accounts
- Fix and test backups
- Fix cookies, add DMARC
- Interim AI rule
- Cancel Dropbox, TeamViewer
Days 31–60
With Kosmo Team- Kickoff workshop, AI literacy
- DPO, GDPR records, agreements
- AI usage policy
- Individual dispatch logins
Days 61–90
With Kosmo Team- Order automation
- CRM setup + training
- Adoption check-ins
- E-Rechnung ready before 1.1.2027
Packages & ROI
Savings pass the investment around month 7.5
| # | Package | Price* | Effect per year |
|---|---|---|---|
| 1 | GDPR & AI Act starter | €3,500 | Fine and contract risk removed |
| 2 | Security baseline | €2,500 | ~€50k outage exposure cut |
| 3 | Change management & rollout | €1,500 | Kickoff, tool training, 2 adoption check-ins: people actually use the new tools |
| 4 | Order automation | €8,000 | €29k saved |
| 5 | CRM setup | €4,000 | Fewer lost leads |
| 6 | Delivery-status chatbot | €3,000 | €9.7k saved |
| 7 | E-Rechnung ready | €1,500 | Legal from 1.1.2027; faster invoicing |
*Placeholder prices. €24,000 one-off for all seven packages. Savings assumed evenly spread; risk reduction not counted.
Next step
Book any package within 60 days and the €1,000 audit fee is credited
Included with this audit:
- AI usage policy template
- Offboarding checklist
- Record of processing starter, pre-filled with your tools
- Backup restore test guide
A re-audit in 6 months shows your before and after, including real savings.
This is a compliance and IT check, not legal advice. It is aligned with, not certified against, the standards listed. Legal points should be confirmed with a lawyer. Kosmo Team · kosmo.team