Organise enterprise security in six steps

Toiminnan tarkistuslista

1. 01

   Assign responsibility

   Assign an executive sponsor and operational owners. Identify providers, insurers and crisis contacts without confusing a support contract with incident response capability. For each critical decision, distinguish preparation, approval and execution. Maintain a primary owner and deputy reachable outside normal tools. Verify contracted hours, limits and intervention prerequisites before assistance is needed.

2. 02

   Identify critical services

   Define essential activities, data and suppliers. Have business owners approve realistic, testable recovery objectives. Describe a full chain, such as ordering, payment, confirmation and delivery. An available application may be unusable if identity or accounting export services fail. Recovery objectives must cover these dependencies.

3. 03

   Reduce access and exposure

   Review remote access, privileges, email and exposed services. Remove dormant accounts and unapproved software or AI use. Check an authorised example of an employee or provider joining and leaving. Review accounts, sessions, keys and shared access together. Every exception needs a rationale, review date and accountable owner.

4. 04

   Request supplier evidence

   Check shared responsibilities, subcontractors, data export and exit procedures. Request dated evidence appropriate to the service, beyond a certification logo. Ask a testable question: can you recover data in a usable format and resume an activity? Check attestation scope and test dates. A sales commitment does not replace a demonstration of reversibility.

5. 05

   Exercise continuity

   Simulate loss of email or a critical SaaS. Test offline contacts, restoration and communication decisions with business teams. Announce a scenario and measure decisions, delays and obstacles without disrupting production. An exercise may reveal outdated contacts or payment arrangements dependent on the same account as email.

6. 06

   Track useful measures

   Track remediation times, privileged accounts, tested recovery and handled alerts. Present residual risks and required decisions rather than a global score without a method. Connect each metric to a population, period and decision. Distinguish completed backups from successful restores, and deployed patches from removed exposures. Avoid comparing percentages whose denominators change without explanation.

   Worked example: a small business relies on hosted email for orders and administrator access. Rehearse losing the primary account using a backup contact and an independent channel. Check that recovery information is available without the unavailable account. Record circular dependencies, an owner for each fix and the evidence expected at the next exercise.