Where to start.
WHAT TO ESTABLISH
What devices exist What accounts exist What data you hold and where Who has access to what What you depend on
WHY THAT FIRST
You cannot protect what you have not identified.
WHAT MOST BUSINESSES DISCOVER
Accounts nobody uses Services still connected Data in places nobody remembered Devices held by people who left
HOW TO DO IT
Work through it once, in a session, and write it down.
WHAT TO ASK OF EACH ITEM
What would happen if this were compromised? What would happen if it were unavailable? Who can reach it?
WHAT TO RANK
By what would hurt most.
WHAT TO ADDRESS FIRST
Anything holding money, customer data, or access to everything else.
That usually means email, banking, and your hosting or domain accounts.
HOW OFTEN TO REPEAT IT
Annually, and after any significant change.
