Most small and mid-sized companies do not need a large security programme first; they need the basics done consistently and written down. A short baseline — sign-in, access, backups, updates and devices — covers what most customers and insurers ask about. These four weeks get it agreed, closed and evidenced, with leadership owning the decisions about remaining risk.

Week 1 — Take inventory

Goal: Know what you have to protect.

  1. List the systems the company relies on and who administers each.
  2. List admin accounts and shared accounts.
  3. Note where customer, employee and financial data lives.
  4. List company and personal devices used for work.

You finish with: An inventory of systems, admins, data locations and devices.

Week 2 — Agree the baseline

Goal: Choose a short set of controls everyone will follow.

  1. Require multi-factor sign-in on email, identity and admin accounts.
  2. Set quarterly access reviews and prompt removal for leavers.
  3. Confirm backups exist and test one restore.
  4. Agree update and device security rules, and how exceptions are approved.

You finish with: A one-page security baseline approved by leadership.

Week 3 — Close the gaps

Goal: Fix the most important gaps first.

  1. Compare the inventory with the baseline and list gaps.
  2. Rank gaps by risk and effort.
  3. Give each gap an owner and a due date.
  4. Record any risk leadership chooses to accept, with a reason.

You finish with: A ranked gap list with owners, dates and accepted risks.

Week 4 — Keep evidence

Goal: Be ready for questionnaires and audits.

  1. Keep simple evidence for each control: screenshots, exports or reports.
  2. Write standard answers to common security questions from that evidence.
  3. Schedule quarterly reviews of access, backups and devices.
  4. Name who updates the baseline as the company changes.

You finish with: Evidence on file, standard answers and a review schedule.

Common pitfalls

  • Starting with tools before knowing what systems and data you have.
  • Writing a long policy nobody follows instead of a short baseline.
  • Marking controls done without evidence.
  • Answering security questionnaires from memory.

See it as a workflow

Leadership

A security baseline for a growing company

Put the basic security controls in place that customers, insurers and investors expect, with an owner and evidence for each, before a questionnaire or incident forces the issue.

See the workflow

More guides like this

Related answers

Read as Markdown Fractional CTO