---
title: "Set a security baseline in 30 days"
description: "A four-week playbook to inventory your systems, agree a short list of security controls, close the most important gaps and keep evidence ready for customers and insurers."
url: https://lidvizion.ai/guides/set-a-security-baseline-in-30-days/
site: Lid Vizion
index: https://lidvizion.ai/llms.txt
---

[Field guides](https://lidvizion.ai/guides/) 4 steps

# Set a security baseline in 30 days

A four-week playbook to inventory your systems, agree a short list of security controls, close the most important gaps and keep evidence ready for customers and insurers.

For: Founders, COOs and technology leads in growing companies facing their first serious security questionnaire, insurance review or customer audit.

Most small and mid-sized companies do not need a large security programme first; they need the basics done consistently and written down. A short baseline — sign-in, access, backups, updates and devices — covers what most customers and insurers ask about. These four weeks get it agreed, closed and evidenced, with leadership owning the decisions about remaining risk.

## Week 1 — Take inventory

**Goal:** Know what you have to protect.

1. List the systems the company relies on and who administers each.
2. List admin accounts and shared accounts.
3. Note where customer, employee and financial data lives.
4. List company and personal devices used for work.

**You finish with:** An inventory of systems, admins, data locations and devices.

## Week 2 — Agree the baseline

**Goal:** Choose a short set of controls everyone will follow.

1. Require multi-factor sign-in on email, identity and admin accounts.
2. Set quarterly access reviews and prompt removal for leavers.
3. Confirm backups exist and test one restore.
4. Agree update and device security rules, and how exceptions are approved.

**You finish with:** A one-page security baseline approved by leadership.

## Week 3 — Close the gaps

**Goal:** Fix the most important gaps first.

1. Compare the inventory with the baseline and list gaps.
2. Rank gaps by risk and effort.
3. Give each gap an owner and a due date.
4. Record any risk leadership chooses to accept, with a reason.

**You finish with:** A ranked gap list with owners, dates and accepted risks.

## Week 4 — Keep evidence

**Goal:** Be ready for questionnaires and audits.

1. Keep simple evidence for each control: screenshots, exports or reports.
2. Write standard answers to common security questions from that evidence.
3. Schedule quarterly reviews of access, backups and devices.
4. Name who updates the baseline as the company changes.

**You finish with:** Evidence on file, standard answers and a review schedule.

## Common pitfalls

- Starting with tools before knowing what systems and data you have.
- Writing a long policy nobody follows instead of a short baseline.
- Marking controls done without evidence.
- Answering security questionnaires from memory.

Want a hand getting started?

## Fractional CTO

Senior technical ownership for companies that need direction and execution without immediately adding a full-time CTO.

[See how it works](https://lidvizion.ai/services/fractional-cto/) [Talk this playbook through](https://lidvizion.ai/contact/?need=fractional-cto&from=%2Fguides%2Fset-a-security-baseline-in-30-days%2F#write)

## See it as a workflow

- [A security baseline for a growing company](https://lidvizion.ai/use-cases/security-baseline-for-a-growing-company/): Leadership Put the basic security controls in place that customers, insurers and investors expect, with an owner and evidence for each, before a questionnaire or incident forces the issue.

## More guides like this

- [The first 30 days with a fractional CTO](https://lidvizion.ai/guides/first-30-days-with-a-fractional-cto/)
- [Review your cloud bill in two weeks](https://lidvizion.ai/guides/review-your-cloud-bill-in-two-weeks/)

## Related answers

- [How is a fractional CTO engagement usually priced?](https://lidvizion.ai/answers/how-is-a-fractional-cto-engagement-priced/)
- [What is the difference between a fractional CTO and a technology consultant?](https://lidvizion.ai/answers/fractional-cto-vs-technology-consultant/)

Bring the messy version

## One workflow. A better way to run it.

Show us the tools, the handoffs, and the part that keeps slowing your team down.

[Let’s map your workflow](https://lidvizion.ai/contact/) · [Read our approach](https://lidvizion.ai/approach/)