Security Program Starter Checklist

A — GOVERNANCE & OWNERSHIP

Who owns this?

01One named person owns security — with authority and allocated time, not just the title."Everyone's responsibility" means nobody's responsibility.

02A governing security document exists, was reviewed within 12 months, and staff have actually read it.

03It is decided in writing who can order shelter, relocation or evacuation — and that person has a deputy.In the incident is the wrong time to discuss mandates.

04Leadership reviews the security risk picture at least quarterly.

B — PEOPLE

Your largest attack surface

05New hires are screened before they get access — including contractors, consultants and interns.

06Onboarding AND offboarding follow a written checklist: accounts, keys, badges, briefings.Offboarding is where most organisations leak.

07Someone would notice an insider problem — behavioural changes, odd access patterns, unusual requests.

08Every employee received security awareness training within the last 12 months.

09Work travel to demanding locations is risk-assessed before departure and tracked during.

C — INFORMATION

What leaves the building invisibly

10Information is classified — staff know what may be shared, with whom, on which channels.

11Access rights are reviewed on a schedule — and revoked the same day someone leaves.

12An intrusion would be noticed: someone receives the alert, and there is a first action defined.

13If primary systems and communications failed today, a tested fallback exists.Tested. A fallback that has never been used is a hypothesis.

D — PHYSICAL & OPERATIONS

The walls themselves

14Site access is controlled; visitors are logged and escorted.

15Critical assets and keys are in a register that matches reality.

16Staff accommodation and routine routes in demanding locations have been assessed.

E — INCIDENTS & CRISIS

When it happens anyway

17Every employee can reach one point of contact for incidents, 24/7 — and knows it by heart.

18The crisis plan has been exercised — not just written — within 12 months.

19Incidents are logged and reviewed, and lessons actually change procedures.

20You could show an insurer, donor or lender your documented security posture tomorrow morning.

Gaps are normal. Unowned gaps are not.

Attacks succeed in the blind spots between disciplines — the unvetted contractor, the unassessed journey, the incident nobody owned. A Security Baseline Review covers all twenty questions in depth in 5–7 days, fixed price, and ends with a prioritised 90-day plan your team can run.

Discuss your score — 30 min, no obligation