The key takeaways
- Check operational coverage as well as purchased tools.
- Define response authority and provider handoffs.
- Validate recovery and track the gaps to completion.
Know what the organisation depends on
Begin with the services, systems and information that are important to operations. Identify their owners and the suppliers involved in supporting them. This establishes a business context for security decisions and helps separate an inconvenience from an incident that could interrupt a critical activity. Review the inventory as the organisation changes.
Check the basics across the whole environment
Ask whether supported devices have appropriate protection, operating systems are maintained and administrative access is controlled. Review account lifecycle processes and multi-factor authentication for the relevant services. Do not evaluate a tool only by its feature list: check deployment coverage, exceptions and whether someone reviews failed agents or missing logs.
Connect detection with action
A suspicious alert needs an owner, enough context for investigation and a defined escalation path. Ask which systems are monitored, during what hours, and who is authorised to isolate a device or restrict an account. If a managed service is involved, review the handoff between the provider and your internal decision-makers. An alert without a response arrangement creates a false sense of readiness.
Review recovery separately from prevention
CISA recommends maintaining protected backups and regularly testing their availability and integrity. Bring that principle into a business discussion: which services can be restored, what access is needed and how will clean recovery points be identified? Review the independence of backup administration and the availability of recovery instructions during an incident.
Exercise the decisions before an incident
A tabletop discussion can explore who declares an incident, how management is informed and which actions require approval. Include IT, business leadership and the relevant specialist advisers. The exercise should reveal missing contacts, unclear authority and supplier dependencies. Its purpose is to improve decisions, not to suggest that a discussion replaces technical testing.
Track a short improvement programme
End the review with prioritised actions, accountable owners and dates. Focus on gaps that materially affect exposure or recovery instead of accumulating an unmanageable list. Review progress and retest important changes. No programme can remove every threat, but disciplined ownership can make the organisation better prepared to detect, contain and recover from disruption.
Further reading
Cybersecurity for your organisation.
Identify the gaps that matter, strengthen your defences and prepare your people to respond. We bring together security technology, operational processes and practical risk management.
Explore the service