More than 90% of breached organizations had fewer than 1,000 employees, and ransomware appeared in 88% of SMB breaches, according to Verizon's 2025 Data Breach Investigations Report executive summary. Say a Seattle software founder receives a customer security questionnaire while the operations manager is investigating an unfamiliar administrator account. The immediate problem isn't the absence of a longer policy. It's whether anyone owns the account, can explain its permissions, and knows what to do next.
A Program Sized to the Business You Run
A cybersecurity compliance program is the combination of owners, risk decisions, controls, and records that demonstrates how a business meets its legal and contractual duties in practice. A policy describes intended conduct. A working program shows who performed the control, what happened, and who accepted any remaining risk.
For that software founder, a sensible starting scope might be the customer database and the systems used to administer it. Trying to document every application before protecting customer records can leave the most consequential work unfinished.
The business-size distinction matters when choosing that scope.
Use a framework without mistaking it for certification
Published on February 26, 2024, NIST Cybersecurity Framework 2.0 provides a flexible taxonomy rather than a certification, organized around Govern, Identify, Protect, Detect, Respond, and Recover, with four implementation tiers: Partial, Risk Informed, Repeatable, and Adaptive. The tiers describe the rigor and repeatability of risk-management practices, not the number of security products purchased.
An organizational profile can cover the whole company or a narrower scope, such as payments or customer data. The founder can therefore choose a boundary that the team can manage, while recording which connected systems and suppliers affect it.
CSF 2.0 functions and the evidence a lean program keeps
| Function | What the team decides | Evidence to keep |
|---|---|---|
| Govern | Risk tolerance, policy owners, and who may accept exceptions | Approved risk statement, policy versions, management sign-off |
| Identify | Which systems and data are in scope | Asset and data inventory with owners |
| Protect | Who can access critical systems and how backups are held | Access reviews, MFA status, backup configuration |
| Detect | How alerts reach a named person | Alert routing, log sources, monthly review notes |
| Respond | Who declares severity and calls counsel | Severity criteria, escalation roster, exercise record |
| Recover | How fast a critical system can be restored | Restore test date, result, and gaps |
In the customer-database scenario, Govern means the founder decides whether a temporary access exception is acceptable. Detect means an administrator alert reaches someone who can investigate, rather than an unattended shared mailbox. Recover means someone has restored usable records, not merely checked that a backup job displayed green.
Practical rule: A smaller set of continuously tested safeguards, with named owners and retrievable evidence, beats an expansive policy library that the team can't operate.
This quarter's decision should be the critical scope, not the software purchase. More controls aren't automatically better compliance.
How to Stand Up the Program
Say a prospective customer asks for security evidence before signing a services agreement. The founder needs a build sequence that produces usable records, not a scramble to purchase policies that describe controls nobody performs.
The implementation sequence should connect business obligations to actual safeguards.
Build from obligations to accountable work
NIST's CSF resources support comparing Current Profiles with Target Profiles, giving startups a risk-based way to organize improvement rather than treating compliance as a certificate.
Write the organizational context. Record products, operating locations, customers, data, and responsible stakeholders. Counsel should assess whether the business is an SEC registrant, HIPAA covered entity or business associate, financial institution under Gramm-Leach-Bliley, or consumer-data business subject to state privacy and breach laws. Offering goods or services to people in the EU should prompt a GDPR applicability assessment, not an assumption that geography alone settles the question.
Extract contractual duties. Review customer master services agreements, data processing agreements, and cyber-insurance applications. Put notification promises, security representations, audit rights, and coverage-related duties into an obligations register. A common miss is approving a sales commitment without checking whether operations can meet it.
Build the Current Profile. Describe existing outcomes across Govern, Identify, Protect, Detect, Respond, and Recover for the selected scope. Record what happens. An undocumented restore capability shouldn't become a completed control because a provider advertises backups.
Define the Target Profile. Match desired outcomes to actual obligations and business needs. A customer-data platform may need stronger administrator controls than a public marketing site. Copying every control from a large framework obscures that distinction.
Document the gaps in a shared register. Connect each missing outcome to the affected system, obligation, evidence, and proposed remedy. This prevents legal, operations, and engineering from maintaining incompatible versions of the same problem.
Prioritize by risk. Evaluate likelihood, impact, asset criticality, and regulatory exposure. Internet-facing systems and identity deserve early attention because they provide direct paths into the environment. A cosmetic policy update shouldn't displace an exposed administrator interface.
Assign owners and deadlines. Give each gap an accountable person with authority to coordinate completion. Approved exceptions need an expiration date and a recorded acceptance of residual risk, not an indefinite “later” status.
Set a repeat cadence. A practical starting schedule is quarterly review of high-risk items and annual reassessment of the full profile. Material changes, including acquisitions or a new customer-data service, should trigger earlier review.
Make evidence part of completion
The failure mode is treating compliance as a project that ends when someone signs the policy. A gap isn't operationally closed until the owner can produce the relevant evidence.
For teams delegating safeguards to a managed service provider, GoSafe Dark Web monitoring's resource on how to prepare for MSP compliance in 2026 can support discussion of responsibility boundaries. Outsourcing a task shouldn't leave uncertainty about who reviews the result.
A supporting video can accompany the team's implementation discussion.
From the beginning, the evidence set should include asset inventories, access reviews, vulnerability records, vendor assessments, incident exercises, policy acknowledgments, and management approvals. This quarter, leadership should approve the profiles and fund the highest-priority gaps.
Controls Worth Measuring Every Month
An engineer closes a patch ticket after updating a VPN appliance. The vulnerability scanner still detects the flaw because the change affected the standby device, not the active appliance. A completed ticket and a remediated vulnerability aren't the same thing.
Verizon's 2025 DBIR findings covered more than 22,000 security incidents, including 12,195 confirmed breaches: vulnerability exploitation accounted for 20% of initial access, credential abuse for 22%, and edge devices and VPNs represented 22% of vulnerability-exploitation targets, with only about 54% fully remediated during the year and a median remediation time of 32 days. Those findings justify treating vulnerability management as an operating control rather than a policy statement.
The monthly review should make unresolved exposure visible.
Verify remediation rather than ticket activity
Maintain a complete asset and software inventory, then scan internet-facing systems at least monthly and after material changes. Rank findings by exploitability and business impact, not severity labels alone. An actively exploited perimeter flaw needs a shorter service-level objective than an isolated, low-impact configuration issue.
Each remediation record should retain:
- Identification: Affected asset, original detection date, and risk rating.
- Treatment: Compensating control and the patch or configuration change applied.
- Validation: Rescan result showing whether the exposure was removed.
- Exception: Approver, business reason, residual risk, and expiration date.
For cloud workloads, the ownership question is especially important. A provider may secure its infrastructure while the customer remains responsible for account permissions or workload configuration; a cloud security compliance review can help structure that allocation.
Pair patching with access, recovery, and alert checks
Quarterly access reviews should examine privileged accounts and departed-user access. The reviewer should compare identity-provider records with application-level permissions, because disabling a central account may not remove a separate local login.
A restore test should cover the system holding customer or financial data. Keep the dated result, including whether the restored application opened, records were usable, and dependencies worked. Together, vulnerability validation, access review, and recovery testing give counsel and executives objective evidence that the written program operates.
Monitoring belongs in the monthly routine too. Name the log sources feeding each alert route, such as identity-provider sign-ins, VPN events, cloud audit logs, and endpoint detections. Confirm that alerts from internet-facing systems reach a named person, then retain a review note recording who examined what and which alerts were closed or escalated.
Leadership should receive a compact monthly scorecard: internet-facing findings still open, median days to remediate exploited perimeter issues, and whether the last restore test passed. A failed test should trigger an owner and action, not disappear inside a reassuring average.
Third Parties and AI You Do Not Own
A salesperson uploads customer meeting notes into an AI assistant to draft a proposal. Procurement has approved the subscription expense, but nobody has checked whether the provider may retain the notes, use them for training, or pass them to another service. The company has accepted a data-use decision without naming a decision-maker.
The survey gaps are substantial. EY's global third-party risk survey publication provides context including EY's 2025 finding that cyberattack losses more than doubled since the pandemic and more than quadrupled since 2017, PwC's 2025 Digital Trust Insights finding that only 2% of 4,042 executives across 77 countries reported implementation across all surveyed cyber-resilience areas, and the 2025 ACA benchmarking finding that only 24% of firms had third-party AI policies while more than half lacked both policies and near-term plans. Cloud-related risks and third-party breaches were among the threats for which organizations felt least prepared.
Separately, Harris Poll research for NAVEX in 2025 found that 58% of risk-and-compliance professionals said their organizations screened third parties for regulatory compliance, while 54% screened for cybersecurity and data protection.
Match diligence to dependence
A vendor's importance comes from its data access and the consequences of failure, not its subscription price.
Vendor tiers and diligence requirements
| Vendor tier | Who qualifies | Diligence required | Minimum contract terms |
|---|---|---|---|
| Tier 1 | Production access, personal data, or a breach-response role | Contract and evidence review, refreshed annually | Incident notice timing, subcontractor flow-down, deletion or return of data, access termination |
| Tier 2 | Limited data access, no production access | Security questionnaire and current certification check | Confidentiality, material-change notice, data return |
| Tier 3 | No data or system access | Short onboarding questionnaire | Standard terms |
| AI tools touching customer or confidential data | Treat as Tier 1 by default | Evidence review and training-use restriction confirmation | No training on company data, named owner approves each model |
The review should connect procurement, legal, and operations rather than ending with a questionnaire.
Incident terms should specify notification timing, available facts, cooperation, and evidence preservation. Subcontractor protections should follow the data, and termination terms should address access removal and verified deletion or return. Each review needs a refresh date and an owner, as part of third-party cyber risk management.
Set an approval boundary for AI
Beyond Surplus's discussion of navigating AI cybersecurity compliance demands offers context for the internal approval conversation. The practical rule should prohibit shadow deployments, restrict training on customer or confidential data, and name who may approve a new model.
When a supplier can't answer, the purchaser should limit the data, add a compensating control, or decline the tool. This quarter's procurement decision should establish those stop conditions.
A signed security questionnaire is evidence of process, not proof that the vendor is safe.
Breach Clocks Counsel Cannot Miss
An alert arrives late in the day. Engineering knows an attacker accessed a storage account, but the founder assumes the notification deadline starts only after the investigation finishes. That assumption can derail an otherwise competent response.
For U.S. public companies, the SEC's explanation of its cybersecurity disclosure rules states that the rules became effective September 5, 2023, generally require disclosure within four business days after materiality determination, and permit an Attorney General-based national-security or public-safety delay initially extending up to 30 days, subject to the rule's conditions and extension provisions. Discovery and materiality are different events.
Put the trigger beside the deadline
Form 8-K Item 1.05 requires materiality determination without unreasonable delay and disclosure of the incident's nature, scope, timing, and actual or reasonably likely material impact. The company can't postpone its decision just to delay filing.
For covered personal-data breaches, GDPR Article 33 requires controller notification without undue delay and, where feasible, within 72 hours after awareness, unless the breach is unlikely to risk individuals' rights and freedoms. Late notification requires an explanation; processors must notify controllers without undue delay, and controllers must document every personal-data breach.
Notification clocks a compliance program must support
| Regime | Clock | Starts when | Must cover |
|---|---|---|---|
| SEC Form 8-K Item 1.05 | Four business days | Materiality determination, not discovery | Nature, scope, timing, material impact |
| SEC Attorney General delay | Initial period up to 30 days, extendable under the rule's conditions | Attorney General determination of substantial national-security or public-safety risk | Delay authorization under the final rule's conditions |
| GDPR Article 33 | 72 hours where feasible, without undue delay | Controller becomes aware | Nature, approximate categories and numbers of people and records where possible, consequences, mitigation |
| GDPR no-notice cases | Still document | Awareness of any personal-data breach | Facts, effects, remedial action |
| State U.S. breach laws | State-specific statutory deadline | Discovery or determination as the statute specifies | Affected residents and regulators as required |
Preserve the decision history
State breach statutes differ and may require notice in the most expedient time or without unreasonable delay. Counsel should maintain a jurisdiction matrix rather than assume a single national clock. Contractual notice requirements belong alongside that matrix.
The incident log should show awareness time, decision time, and who was told, including the basis for a no-notice decision. Any Attorney General notice and the authorized delay's end date should be recorded explicitly.
Private companies should adopt the governance discipline without assuming the SEC filing duty applies to them: severity criteria, named decision-makers, legal escalation, and preserved evidence. A data breach notification letter is a communication tool, not a substitute for determining recipients, triggers, and required content.
This quarter, leadership should test whether the incident roster can reach the people authorized to make those decisions.
Training, Policy Upkeep, and Audit Readiness
A new employee receives a policy acknowledgment through the HR platform, clicks through it, and later approves an unfamiliar vendor's access request. The completion report looks tidy. The employee still hasn't learned how to challenge the request.
Role-based training should explain the decisions the employee makes. As an internal operating standard, give new hires a security briefing within 30 days, repeat it annually, and keep completion records beside the relevant policy acknowledgments. Finance should practice payment-change verification; engineers should practice secret handling; managers should understand access approvals.
Keep policies attached to behavior
Each policy needs a named owner, version number, annual review date, and change log. Acknowledgment records receipt or attestation, not reliable proof of compliant behavior, so pair it with a spot check of access requests or vendor onboarding.
- Exceptions: Name the decision-maker in the risk register and expire every waiver. Otherwise, a temporary workaround quietly becomes the normal control.
- Affordability: Record the cheaper alternative and residual risk when the preferred safeguard isn't affordable. A documented compensating control is more useful than a copied requirement nobody performs.
- Exercises: Run an annual vendor-compromise or ransomware tabletop. Save decisions, uncertainties, and assigned corrective actions rather than only the presentation.
These habits turn cybersecurity best practices into checkable work. The reviewer should be able to trace a policy requirement to an operational record.
Maintain a customer-ready evidence packet
Keep a controlled folder containing the current inventory scope, latest access review, latest restore test, vendor tier list, and last tabletop date. Refresh each item when the underlying event happens rather than immediately before a sales deadline. Share appropriately redacted copies instead of exposing sensitive configurations.
The UK government's 2024 Cyber Security Breaches Survey found that 39% of businesses acted on at least five of the ten recommended cyber steps, while only 3% implemented all ten. That adoption gap isn't permission to ignore applicable requirements; it reinforces the need to distinguish functioning safeguards from paper completeness.
Customers, insurers, and regulators shouldn't receive promises that the program prevents every incident. A useful quarter-end review examines owners, open exceptions, and training completion over a 90-day operating window, then records what leadership will change.
Set This Quarter's Compliance Priorities
A founder leaves a planning meeting with a framework, a vendor proposal, and a long remediation spreadsheet. None of those materials answers the question that matters most: which exposure will receive an owner and funding now?
The quarter should end with three decisions, not another unranked list. Each decision should fit the business's actual data, customers, and operational dependencies.
Choose the scope, the gap, and the decision path
- Choose the critical scope. Name the system whose failure would cause the most consequential harm, whether that means customer records, payments, or the platform customers contractually audit. Define the boundary clearly enough that engineering and counsel are discussing the same environment.
- Choose the highest-exposure gap. Select the unresolved issue with the greatest regulatory or customer consequence, then assign an owner and completion date. Buying another tool shouldn't count as closure unless the underlying outcome improves.
- Choose the legal escalation path. Determine whether the incident roster can reach legal advice early enough to assess materiality and notification duties. A contact list that nobody has tested isn't a reliable decision path.
Counsel adds particular value before an incident by determining which HIPAA, Gramm-Leach-Bliley, state breach, GDPR, or SEC obligations apply. That review should align customer notice promises with legal triggers and check whether cyber-insurance notice duties create conflicting expectations.
The defensible standard: Reasonable, documented, and improving, not absolute security.
Make the handoff concrete
Once leadership has selected the scope, the legal discussion should begin with the relevant contracts, data flows, unresolved exceptions, and insurance documents. That packet allows counsel to address the business's actual obligations instead of drafting policies in isolation.
By Design Law Firm & Legal Consultancy, PLLC's data privacy attorney is a certified privacy professional. A useful engagement starts with the chosen scope and the decisions leadership needs to make, rather than a claim that every risk can be eliminated.
The immediate priority is therefore concrete: identify the critical system, assign the consequential gap, and confirm who can obtain legal advice during an incident. Those choices give the cybersecurity compliance program an operating purpose.
By Design Law Firm & Legal Consultancy, PLLC offers data privacy compliance support, policy drafting, breach-response planning, technical-contract advice, and assistance with cyber-insurance needs. For help turning a chosen business scope into documented duties and workable procedures, founders can visit By Design Law Firm & Legal Consultancy, PLLC or call (206) 593-1519.
