🗝️ Identity & AccessEvery employee signs in through single sign on (Okta, Google, or Microsoft), not separate passwords per app Multi factor authentication is required for email and every business app When someone leaves, all their access is turned off the same day, and someone can prove it There is a written list of who has admin rights to what
🧭 Leadership & VendorsSomeone owns the IT budget and reviews it at least once a year Software renewals are tracked with dates, so nothing auto renews unnoticed Every vendor contract has a named owner and a negotiated rate, not list price There is a written technology roadmap for the next 12 months
🔒 Security & ComplianceEvery laptop has endpoint protection and disk encryption, enforced centrally Staff get phishing and security awareness training at least twice a year Backups exist, are tested, and someone knows how long a restore takes You could pass a customer security questionnaire or SOC 2 readiness review today
🤖 AI GuardrailsThere is a written policy on which AI tools staff may use and what data may go into them AI tools are on a business plan with admin controls, not personal accounts Someone can see AI usage and spend across the company Staff have had at least one training session on using AI safely
🏗️ Infrastructure & OfficeThe network, Wi-Fi, and firewall are documented and managed, not a box someone bought once Cameras, door access, and conference rooms have a single owner who maintains them A new hire gets a working laptop, accounts, and a desk setup on day one without scrambling
🧩 Tools & AppsYou know the total monthly spend across every SaaS tool the company uses Your core tools (CRM, projects, tickets, scheduling) share data instead of living in silos Nobody is running an important process out of a spreadsheet that should be an app
