Know what to protect. Know what to tackle first.

A usable record of your systems and information, with clear ownership.

• A populated register of the systems, devices, services and information within the agreed scope.
• Key details for each entry, including its purpose, owner, location and business importance.
• A simple process for keeping the register current as the business changes.

A shared view of what could go wrong, how it would affect the business and which risks deserve attention.

• A focused workshop covering important systems, information, existing protections and possible security incidents.
• A risk register with agreed criteria for assessing likelihood and business impact.
• A findings summary with initial priorities, assumptions and questions that need follow-up.

Clear actions for the risks you choose to address, with owners and a realistic sequence.

• Options for handling each agreed risk, with the costs and tradeoffs explained.
• A treatment plan with actions, proposed owners, dependencies and target dates.
• A record of agreed decisions, remaining risks and when to review them.

A clear set of minimum protections, so teams and suppliers know what is expected.

• An agreed set of security requirements based on your risks, customer expectations and existing practices.
• Plain descriptions of each required protection and where it should apply.
• A record of gaps, responsibilities, exceptions and review dates.

Recovery priorities based on business impact, with clear limits on how long key activities can be disrupted.

• A review of essential business activities and how the impact of disruption grows over time.
• A record of the people, information, systems and suppliers those activities depend on.
• Agreed recovery priorities and target timeframes for checking against your technical recovery plans.

A clear map of the systems behind essential work, so key dependencies are easier to protect.

• A list of the systems that support your essential business activities.
• A map of their key connections, information flows and external dependencies.
• Named owners, known dependency risks and gaps to investigate.

A manageable order for the work, with urgent risks separated from improvements that can wait.

• A review of existing findings, recommendations and work already planned or underway.
• A ranked improvement list based on business impact, urgency, effort and dependencies.
• A focused set of next steps, with the reasons for priorities and deferred work recorded.

Simple information categories and handling rules your team can use in daily work.

• A small set of information categories based on sensitivity and business impact.
• Practical rules for access, sharing, storage and disposal, with examples from your business.
• An initial classification of agreed information types, with owners and a guide for applying the approach.