An incident response plan is a short document that says who to call, who decides, and what gets done in the first hour when something goes wrong. For most small and mid-sized businesses the useful version is one page of roles and phone numbers plus three or four short...
Vendor risk management is the process of knowing which outside companies can hurt your business, deciding how much scrutiny each one deserves, and checking them on a schedule. For a small or mid-sized business the whole process fits on two tabs of a spreadsheet: an...
A risk register is a single list of the things that could damage your business, each one scored, assigned to a named owner, and given a review date. If you want to know how to build a risk register, the short version is this: list what could go wrong, rate how likely...