Security for your company
Security guides for owners and leaders responsible for a whole organization, from a first security plan to SSO, device management, vendor checks, SOC 2 and incident response.
Once you have a team, security becomes a leadership job. Someone has to decide what gets protected first, set the rules, choose the vendors, answer the questions clients and insurers ask, and lead when something goes wrong. These guides are for that person.
They build on the personal basics in Keeping your accounts & website safe: strong passwords, password managers, two-factor authentication, and recognizing phishing. If your team hasn't covered those yet, start there. This section doesn't repeat them.
If you only read three things
- Your company security plan: where to start: the two-page plan everything else hangs on.
- Incident response: who does what in the first hour: set this up before you need it.
- Security for executives: you are the target: why your own accounts matter most.
The path through this section
- Make a plan and name an ownerA plan, an owner and a written policy
- Get control of accessSingle sign-on and managed devices
- Protect the people attackers want mostExtra protection for leaders
- Check outward and answer inwardVendor checks and client questionnaires
- Be ready for a bad dayIncident response and cyber insurance
Stage 1 of 5: Make a plan and name an owner
Your company security plan uses the NIST Cybersecurity Framework as a simple outline.
Writing a simple security policy turns it into rules your team will follow.
Stage 2 of 5: Get control of access
Single sign-on gives you one place to switch access on and off.
Managing company laptops and phones covers the devices.
Stage 3 of 5: Protect the people attackers want most
Security for executives covers impersonation, SIM swaps, and admin accounts.
Stage 4 of 5: Check outward and answer inward
Vendor risk is what you ask your software providers.
Security questionnaires and SOC 2 is what bigger clients will ask you.
Stage 5 of 5: Be ready for a bad day
Incident response and cyber insurance work best when they're planned together.
Start here
Your company security plan: where to start
A two-page security plan for a small or growing company, built around the NIST Cybersecurity Framework.
Writing a simple security policy for your team
A short, readable policy outline your staff will actually follow.
Access & devices
Single sign-on (SSO) and why it matters as you grow
One company identity in charge of every app, and one switch when someone leaves.
Managing company laptops and phones (MDM basics)
Enforce screen locks, encryption and updates, and handle personal phones fairly.
Security for executives: you are the target
Why leaders are singled out, and the protections that matter most for you.
Vendors & clients
Vendor and third-party risk: what to ask your software providers
The questions to ask before you hand your data to a provider, and how to judge the answers.
Security questionnaires and SOC 2: what bigger clients will ask you
How to answer questionnaires honestly, and what SOC 2 Type I and Type II really mean.
When things go wrong
Incident response: who does what in the first hour
Roles, a call order, and the mistakes that make an incident worse.
Cyber insurance: what insurers check before they cover you
The controls insurers ask about, and how to answer the application accurately.
Related sections
- Keeping your accounts & website safe: the personal security basics for everyone on your team
- Risk & resilience: onboarding, offboarding, and recovering from lost accounts
- Compliance: GDPR, CCPA, HIPAA, PCI and accessibility law
- Giving us access, explained: how to share access with an agency safely, and take it back
Go deeper on chykalophia.com
Talk it through
Want a second pair of eyes on this?
Book a free discovery call, up to an hour. Bring the question you're stuck on and we'll tell you honestly what we'd do.
Already a client? Email support@chykalophia.com.
Last updated
When a no-code automation becomes a custom integration
The signs that your Zapier or Make setup has outgrown no-code, and how to decide whether a custom integration is worth it.
Your company security plan: where to start
A practical first security plan for a small or growing company, built around the NIST Cybersecurity Framework and sized for people without an IT department.