Start with the systems that matter

List the devices, cloud accounts, business applications, domains, and data stores your team depends on. Record who owns each one, how it is accessed, and whether it contains customer, employee, financial, or operational data. Include third-party tools and former employee accounts; these are easy to miss when a company grows quickly.

Prioritize systems by the business impact of losing access, exposing data, or changing records. This gives leaders a practical starting point for cybersecurity consulting and risk-management conversations.

12 controls to review this quarter

  1. Multifactor authentication: Require MFA for email, identity providers, administrative consoles, finance tools, and remote access.
  2. Account lifecycle: Remove access promptly when roles change or people leave; review privileged accounts on a schedule.
  3. Device protection: Keep supported operating systems, disk encryption, endpoint protection, and screen locks enabled on business devices.
  4. Patch ownership: Know who tracks security updates for operating systems, browsers, routers, and business-critical applications.
  5. Email defenses: Configure domain protections, limit risky forwarding rules, and train staff to report suspicious messages.
  6. Backups: Identify what is backed up, how often, who can alter backups, and when a restore was last tested.
  7. Cloud permissions: Review public sharing, admin roles, service accounts, and unused credentials.
  8. Data handling: Define where sensitive data may live, who can access it, and how long it should be retained.
  9. Vendor access: Inventory external providers, integrations, data shared with them, and access that can be revoked.
  10. Secure software changes: Require review and testing before changes reach production, including infrastructure configuration.
  11. Incident contacts: Keep a current list of internal decision makers, key vendors, counsel, and recovery contacts.
  12. Practice: Walk through a realistic account-compromise or service-outage scenario and record what was unclear.

These controls are a starting point, not a certification or a guarantee of security. The NIST Cybersecurity Framework offers a broader structure for organizing and communicating risk.

Turn a checklist into ownership

For every gap, record four things: the risk, the next action, the accountable owner, and the review date. Separate urgent exposure from longer-term engineering work. A missing MFA requirement on an administrator account deserves a different response from a planned network redesign.

Revisit the list after a major hire, new SaaS tool, acquisition, infrastructure change, or security incident. A checklist only helps when it stays connected to how the business actually operates.

A lightweight quarterly review can fit into an existing leadership or engineering meeting. Ask what changed since the last review, whether a control failed or was bypassed, and whether a business owner has accepted any remaining risk. Record decisions where the people responsible can find them; a spreadsheet that no one maintains is not a control.

When to bring in outside help

Consider an independent review when no one can confidently explain the environment, when access and data have grown faster than internal controls, or when the team needs a prioritized remediation plan. A focused security assessment discussion can begin with scope, business constraints, and the decisions leadership needs to make.

For a deeper look at identity-centered controls, continue with a practical guide to zero trust for small businesses. If cloud permissions are the main concern, see the cloud security assessment guide.