Security & continuity

Connect protection to everyday work

Start with the information, people and processes that need protecting. Consider how accounts are created, permissions change, devices connect and sensitive information moves. Physical security and digital security may need to be considered together, depending on the setting.

• Identity and access: who can do what, for which organisation and for how long?
• Change and maintenance: how are updates checked, approved and recovered?
• Continuity: which work needs to resume first after a disruption?
• Responsibility: who responds, communicates and makes the next decision?

Ask what the promise actually covers

Availability targets, response commitments and recovery objectives are different promises. Ask about the measurement, dependencies, exclusions and agreed responsibilities behind each one. A backup existing is not the same as a service being recoverable.

• Which systems, data and settings must be restored together?
• Has recovery been tested in a usable separate environment?
• What information loss and interruption can the organisation tolerate?
• How are access removal and incident communication handled?

Improve from the situation you have

You do not need to replace everything to start a useful conversation. Bring the current systems, concerns and constraints so the relevant review or service can be scoped around the work you need to protect.