01
Why this review matters
Mid-market companies often have enough technology complexity to create serious cybersecurity and vendor risk, but not enough internal executive technology leadership to manage it proactively.
This is not intended to replace a full penetration test, SOC audit, or compliance engagement. It is an executive-level review that identifies the most important business and technology risks.
02
1. Access and identity
- Who has access to critical systems?
- Are permissions excessive?
- Are former employees, contractors, or vendors still active?
- Is multi-factor authentication enforced?
03
2. Critical business systems
- Salesforce / CRM
- ERP and finance systems
- Email and collaboration platforms
- Data repositories
- Customer portals
- Marketing platforms
- Cloud infrastructure
04
3. Vendor risk
- Which vendors have access to sensitive data?
- Are contracts, SLAs, and security obligations clear?
- Are there overlapping tools or unnecessary subscriptions?
- Are critical vendors creating operational dependency?
05
4. Data protection
- Where is customer, employee, financial, and operational data stored?
- Is sensitive data being exported to spreadsheets?
- Are backup and recovery processes understood?
06
5. Governance
- Who owns technology risk?
- How are security decisions made?
- What policies exist?
- What is missing?
07
Outcome
The result is a prioritized risk register and practical action plan for reducing exposure, improving controls, and strengthening vendor governance.
Next step
Create a practical first-level review of cybersecurity and vendor risk.
Return to the contact area to review another resource, share context with George, or request a follow-up conversation.