SECURITY GUIDE / REVIEWED JULY 22, 2026
Intended outcome: A staged security baseline with owners and recovery checks.
Roll out a minimum security baseline without stopping the business
Sequence account protection, updates, backups, role access, and incident contacts around the work your team must keep doing.
Work through the change in order
- 01
Inventory critical accounts, devices, data, vendors, and owners.
- 02
Protect administrators and critical systems first.
- 03
Pilot multifactor authentication and recovery with a small group.
- 04
Schedule updates and verify backup restoration.
- 05
Expand by role and record exceptions with review dates.
Save evidence for these checks
- Recovery contacts and methods work.
- Former workers and unused accounts are removed.
- Backups can be restored to a usable state.
Hold the rollout when a boundary breaks
- Locked-out administrators
- Unverified backup
- Unknown business-critical dependency