Start where disruption would matter most.

Start with the information and processes the business needs during an ordinary day. Identify the accounts, devices, and cloud services behind them.

The purpose is to connect a security question to a business dependency. Consider what would become difficult if an account were taken over, a device were unavailable, or important information could no longer be trusted. These questions help explain the operational impact.

Who can access important information, change settings, or grant access to other people? Which applications connect to a business account? How are access and recovery responsibilities handled when staff or suppliers change?

These questions make identity and permissions concrete. They can also reveal where a business depends on a person, device, or service it has not previously considered essential.

Updates, device settings, document sharing, authentication, and recovery are useful areas to understand when discussing practical hardening. Their importance depends on the environment and the role each system plays.

A useful priority explains the concern, the business dependency, and what a change would protect. It also considers how people would use the system afterward. The aim is proportionate safeguards that people can understand and sustain.

A new AI tool can introduce a new connection to business information or an existing cloud service. A change in staff, suppliers, or working arrangements can also change who can reach what.

Describe these changes alongside the questions you want to address. Built By Hackers focuses on defensive AI and practical small-business cyber hardening, as a Halsted, Haines & Co. brand within State Madison.

Use this sequence to organize a security review with the person responsible for your systems. It helps turn broad concern into named actions and owners.

1. Identify essential accounts. Start with email, administrator access, document storage, and any service the business could not operate without. Record the business owner for each.
2. Review authentication and recovery. Check whether multifactor authentication is enabled and how access would be recovered if a device or staff member became unavailable. Keep recovery material protected.
3. Check ownership of shared access. Identify shared accounts and vendor access. Establish who approves access and who removes it when responsibilities change. Prefer individually attributable access where the service supports it.
4. Review devices and updates. Identify who manages updates and security settings, and which devices no longer receive vendor support. Confirm that responsibility covers the devices actually used for business.
5. Review cloud sharing and connected apps. Check who can reach important folders and which outside applications or suppliers retain access.
6. Check backups and restoration. Identify what is backed up, how backup access is protected, and when a restoration was last tested. A completed backup job alone does not show how quickly operations can resume.
7. Assign the next action. Record the concern, the system affected, the person responsible, and the date for checking progress. Revisit the list when the environment changes.

Start with a dependency the business cannot easily replace, then examine the access or recovery weakness around it. For example, if one person’s account controls email administration and document storage, understand how that access is protected and how the business would retain control if the person were unavailable.

Separate something you have verified from something you assume. “We have backups” leaves open what is included and whether a restoration works. “The owner restored a sample of the essential records on this date” is a clearer account of what has actually been checked.

Use the list to start a focused discussion, not to declare the environment secure. As people, suppliers, and AI tools change, the dependencies and access paths need another look.

The FTC’s small-business cybersecurity guide explains authentication, updates, and backups. The FBI’s cyber-resiliency guidance also addresses asset ownership, supported systems, and tested recovery. These public resources can support the discussion with whoever manages your business technology.