My score is under 60, what should I do in the next 7 days?

A sub-60 score means at least one critical-severity control is failing. The 7-day stabilisation plan:

Day 1 (today):

• Force-enable admin 2FA if it’s not (q1). 2-hour fix, eliminates the #1 attack vector.
• Rotate all admin passwords. 1 hour.
• Set the admin IP allowlist at nginx/WAF level (q3). 30 min.

Day 2-3:

• Apply all outstanding Adobe security patches (q16, q17). 1 day including UAT.
• If on TLS < 1.2, fix the load balancer config (q6). 30 min.
• Enable HSTS with a short max-age (q7). 1 hour.

Day 4-5:

• Take a fresh encrypted backup + verify the restore works (q11). 2 hours.
• Verify no raw PAN is stored anywhere (q13). Query: SELECT * FROM sales_order_payment WHERE cc_number IS NOT NULL;, should return zero rows.
• Check the PCI scope (q12) with your acquirer; if it’s SAQ D, move to a hosted/tokenized checkout.

Day 6-7:

• Publish security.txt (q22). 1 hour.
• Write a one-page IR plan (q24): who calls who, escalation tree, customer-notification thresholds. Even a 1-page draft beats nothing.
• Re-run the audit. You should be over 70 by end of week.

If anything in the critical-severity list still scores "No" by day 7, that’s a deep-audit conversation. Book one.