The written policies every small business needs come to roughly eight documents, not forty. You need an information security policy, acceptable use, access control, data retention and deletion, incident response, vendor management, business continuity, and a code of...
Vendor risk management is the process of knowing which outside companies can hurt your business, deciding how much scrutiny each one deserves, and checking them on a schedule. For a small or mid-sized business the whole process fits on two tabs of a spreadsheet: an...
A risk register is a single list of the things that could damage your business, each one scored, assigned to a named owner, and given a review date. If you want to know how to build a risk register, the short version is this: list what could go wrong, rate how likely...