The Five-Step Security Baseline for Growing Teams
Know your accounts and devices, own who gets access, map controls to the systems that matter, prepare for one realistic incident, and track every gap.
Updated 6 min read
At a glance
- Who it is for
- Founders, IT owners, and engineering leads who want a starting point before a customer review or an audit deadline.
- Time needed
- A few working sessions for a first pass, more if your account and app lists are out of date. Much of the work is pulling lists from tools you already use.
- What you end up with
- An inventory, named owners for access, a short list of logs and alerts, and a risk backlog with owners, dates, and evidence.
Do this before a customer review or an audit deadline. Each step leaves a record you can show a buyer or an auditor. Treat it as a starting point. A full security program or a compliance assessment goes further.
Each step cites outcomes from the NIST Cybersecurity Framework 2.0. The framework groups its outcomes into six functions: Govern, Identify, Protect, Detect, Respond, and Recover. You do not need to adopt the whole framework to use this baseline.
1. Inventory accounts, devices, and systems
Every later step depends on these lists. NIST CSF 2.0 covers them, with outcomes ID.AM-01 and ID.AM-02: keep inventories of the hardware you manage, and of the software, services, and systems you manage. The CIS Controls start in the same place, with Control 1 for devices and Control 2 for software.
Build four lists:
- Identity providers. Every place people sign in with a company account, such as Google Workspace, Microsoft Entra ID, or Okta.
- Privileged accounts. Every admin, owner, or root account, in the identity provider, the cloud, code hosting, and finance tools. Include shared, service, and break-glass accounts, and note who holds each one.
- Managed devices. Every laptop and phone in your device management tool, and a note on any that are not in it.
- Critical SaaS. The apps that hold customer data, money, or code. The identity provider's app list and company card statements are good places to look.
Give each list an owner and a date. The date tells the next reader how current the list is.
2. Own access: MFA, joiners, leavers, and reviews
For each system on your lists, answer five questions, and write down who owns each answer.
- Is MFA on? CISA's MFA guidance says any MFA is better than none, and that phishing-resistant MFA is the goal. It says: "The only widely available phishing-resistant authentication is FIDO/WebAuthn authentication." Where FIDO is not possible yet, CISA's phishing-resistant MFA fact sheet ranks app-based codes and push with number matching above text-message or voice codes, which it ranks weakest. Start with admin accounts: CIS Safeguard 6.5 requires MFA for all administrative access, and CISA's Cybersecurity Performance Goals (goal 3.F) say to prioritize privileged administrative accounts.
- Who approves new access? Someone should approve access before it is granted.
- Who has admin, and do they still need it? Admins should use a separate admin account only for admin work, as CIS Safeguard 5.4 says. Remove admin rights and access nobody has used recently.
- Who removes it when people leave? Our employee offboarding checklist turns this into a ticket you run every time.
- Who reviews it, and how often? Our post on access reviews that are not theater covers a light cadence.
These map to CSF 2.0 outcomes PR.AA-01, which says identities and credentials are managed, and PR.AA-05, which says access permissions are defined in a policy, managed, enforced, reviewed, and follow least privilege. CIS Control 5 and Control 6 cover the same ground.
3. Map your controls to the systems that matter
Not every system deserves the same effort. CSF 2.0 outcome ID.AM-05 says to prioritize assets by classification, criticality, resources, and impact on the mission.
Take your critical systems from step 1, and for each one write down:
- What it does for the business, and what data it holds
- Which cloud, network, and device controls protect it today
- Whether it is backed up, and when you last restored it
- Whether its software and devices get security updates, and how quickly. CIS Safeguard 7.3 says monthly or more often for operating systems. CSF 2.0 outcome PR.PS-02 says software is maintained, replaced, and removed commensurate with risk.
Our guide to testing a backup restore walks through a first test.
4. Prepare for one realistic incident
Pick one scenario that could happen to you this year, such as a stolen admin login. Then check that you could see it and respond to it.
- Logs. Which systems would record it? CSF 2.0 outcome PR.PS-04 says log records are generated and made available for continuous monitoring. CIS Control 8 covers collecting, alerting on, reviewing, and keeping audit logs.
- Alerts. Would anyone be told? Name the alert and the person who gets it.
- Response. Who decides what happens next, and who tells customers?
A low-cost way to test the response part is to talk it through. Our guide to running an incident response tabletop exercise shows how.
5. Turn the gaps into a backlog
Every "no" or "not sure" from steps 1 to 4 is a gap. Put each one in a single list.
- An owner for each gap
- A target date
- The evidence that will show it is closed, such as a screenshot, a ticket, or a config export
CSF 2.0 outcome ID.RA-06 describes the same habit: risk responses are chosen, prioritized, planned, tracked, and communicated. Outcome GV.RR-02 asks that roles and responsibilities are established and understood. A backlog with names and dates covers both.
Review the backlog on a schedule you will keep, and repeat the baseline after a big change, such as a new product or a new cloud provider.
Where Grey Wing fits
Our IT and Security Programs both start by taking stock of your accounts, devices, apps, and systems. We rank the gaps and work through them with your team. We do not perform audits or certify compliance. If you want help with the first pass, Let’s talk.
Sources
- NIST Cybersecurity Framework 2.0: https://www.nist.gov/cyberframework
- NIST CSWP 29, The NIST Cybersecurity Framework (CSF) 2.0 (ID.AM-01, ID.AM-02, ID.AM-05, PR.AA-01, PR.AA-05, PR.PS-02, PR.PS-04, ID.RA-06, GV.RR-02): https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf
- CISA, More than a Password (MFA): https://www.cisa.gov/mfa
- CIS Controls, Control 1 Inventory and Control of Enterprise Assets: https://www.cisecurity.org/controls/inventory-and-control-of-enterprise-assets
- CIS Controls, Control 2 Inventory and Control of Software Assets: https://www.cisecurity.org/controls/inventory-and-control-of-software-assets
- CIS Controls, Control 5 Account Management: https://www.cisecurity.org/controls/account-management
- CIS Controls, Control 6 Access Control Management: https://www.cisecurity.org/controls/access-control-management
- CIS Controls, Control 8 Audit Log Management: https://www.cisecurity.org/controls/audit-log-management
- CISA, Implementing Phishing-Resistant MFA (fact sheet): https://www.cisa.gov/sites/default/files/publications/fact-sheet-implementing-phishing-resistant-mfa-508c.pdf
- CIS Controls Assessment Specification, Safeguard 5.4 Restrict Administrator Privileges to Dedicated Administrator Accounts: https://controls-assessment-specification.readthedocs.io/en/latest/control-5/control-5.4.html
- CIS Controls Assessment Specification, Safeguard 6.5 Require MFA for Administrative Access: https://controls-assessment-specification.readthedocs.io/en/latest/control-6/control-6.5.html
- CISA, Cross-Sector Cybersecurity Performance Goals 2.0, goal 3.F: https://www.cisa.gov/cybersecurity-performance-goals-2-0-cpg-2-0
- CIS Controls Assessment Specification, Safeguard 7.3 Perform Automated Operating System Patch Management: https://controls-assessment-specification.readthedocs.io/en/latest/control-7/control-7.3.html