Ask a business owner where their company data lives and you usually get a confident answer that covers about sixty percent of the truth. Email is in Microsoft 365. Files are on the server, or maybe in SharePoint now. Accounting is in QuickBooks. That is a real answer and it is not wrong. It is just incomplete, because it leaves out the payroll provider, the industry-specific application the operations team runs, the backup copies sitting with a vendor whose name nobody remembers, and the spreadsheet on one desktop that quietly became the master list of everything.
We want to make the case for one specific exercise: sit down for an afternoon and write out where your data actually is. Not a security assessment. Not a compliance project. A list. It is the least glamorous thing we recommend to clients and it is consistently the one that pays off the most, because almost every difficult decision you will make later, from an insurance application to a two in the morning phone call about an outage, gets easier when the list already exists.
Why a List Beats a Plan
Plans age badly. Lists age slowly. A security plan written two years ago describes a company that no longer exists, but a list of systems is mostly still accurate and takes twenty minutes to update.
This is not our idea. NIST’s Cybersecurity Framework 2.0 Small Business Quick Start Guide puts inventory at the front of the Identify function, telling small businesses to create and maintain an inventory of hardware, software, systems, and services, and to prioritize inventorying and classifying business data. The Federal Trade Commission’s guide Protecting Personal Information: A Guide for Business opens with the same instruction under the heading Take Stock: know what personal information you have in your files and on your computers. Two federal bodies, two different audiences, same first step. When the security world agrees on something this thoroughly, it is usually because everything else depends on it.
The Systems Almost Everyone Forgets
Start with the obvious ones, then keep going. The obvious ones take five minutes. The rest of the afternoon is spent on the systems that never came up in a meeting.
- Email and everything attached to it. Not just the mailboxes. Shared mailboxes, distribution lists, the archive, and any add-in that reads mail on your behalf.
- File storage, in all of its locations. The cloud storage you pay for, the file server nobody has logged into in a year, and the personal drive folders people use because they are faster.
- Accounting, payroll, and benefits. These hold the data most likely to matter in a breach, and they are usually run by outside providers with their own logins and their own security.
- The customer system. A CRM, a scheduling tool, an e-commerce platform, or a shared inbox that functions as one whether you call it that or not.
- The industry application. Every trade has one. Practice management, dispatch, estimating, case management, inventory. It is often the oldest software you own and the least examined.
- Backups, including the ones you inherited. Where do they go, who can reach them, and when did anyone last confirm a restore worked?
- The spreadsheet. There is always a spreadsheet. It lives on one person’s desktop, it contains something important, and it is not backed up.
That last category is worth its own conversation. Tools nobody approved and nobody tracks are what we described in our piece on shadow IT and the hidden risk inside your own organization. A data map is the cheapest way to surface it, because you are asking people what they use rather than telling them what they are allowed to use, and that question gets honest answers.
Four Columns Are Enough
Resist the urge to build something elaborate. A spreadsheet with a handful of columns beats a platform you abandon in March. The NIST small business guide includes a sample asset inventory table, and the columns it suggests are a good model: what the asset is, what it is officially used for, who administers or owns it, whether it holds sensitive data, whether multi-factor authentication is required, and the business impact if access is lost. Here is how we usually frame it for a first pass.
- What it is and what it is for. One line. “QuickBooks Online, accounting and invoicing.” No architecture diagrams.
- Who owns it and who can reach it. Name a person, not a department. Then list who has access, including former employees and outside vendors. This column produces the most surprises.
- What would hurt if it leaked or vanished. Two separate questions with different answers. Payroll leaking is a nightmare. Payroll vanishing for a day is an inconvenience. Your dispatch system is the reverse.
- Where it lives and with whom. The vendor’s name, and where the data physically sits if the vendor tells you. This matters for contracts and for questions you will be asked later.
Mark What Would Hurt Most
Once the list exists, go back through and mark the entries that would genuinely hurt. Not everything is critical, and pretending otherwise is how businesses end up spending equally on the system that runs the company and the one that stores old marketing photos.
The leak question and the loss question deserve separate marks. Systems that hold personal information about customers or employees carry legal weight if they leak. Systems the business cannot operate without carry operational weight if they vanish. A few systems are both, and those are the ones that should get your attention and your budget first. This kind of prioritization is the practical version of the argument we made in why cybersecurity is no longer optional for mid-sized businesses: you cannot protect everything equally, so decide deliberately rather than by accident.
What the Map Pays For Later
The reason we push this so hard is that the map answers questions you will be asked under pressure, by people who need the answer quickly.
- Cyber insurance applications. These ask what data you hold, where it is, and who can reach it. Guessing on an insurance form is a bad idea for reasons that only become clear at claim time.
- Incident response. The first question after any incident is “what was in there.” Without a map, you spend the first day building one while the clock runs.
- Breach notification math. The Texas Attorney General’s office states that a business must notify the Attorney General of a breach affecting 250 or more Texans, no later than 30 days after discovering it, under the Texas Identity Theft Enforcement and Protection Act. Counting affected people is far easier when you already know what each system held.
- Vendor and contract reviews. When a provider changes terms or gets acquired, you already know what you had with them.
- Offboarding. The access column becomes a checklist the day someone leaves.
The Bottom Line
One afternoon, one spreadsheet, four columns. Systems, owners and access, what hurts if it leaks or vanishes, and where it lives. Put a recurring reminder on the calendar to review it twice a year, and add a line to it whenever you sign up for anything new. It will not stop an attack by itself, but it makes every decision after it faster and better informed, and it turns the worst day at your company from an archaeology project into a lookup.
If you would rather not do this from a blank page, we run this exercise with small and mid-sized businesses across Denton County and usually finish it in a single sitting. We will bring the template and the questions. Contact us today.
Sources:
Comments are closed