Intro lesson
Start a Security Plan People Can Follow
Turn “keep us secure” into clear responsibilities, a few useful rules and evidence that the rules are working.
Reviewed September 2026 · 3 minute read
A rule needs a way to work
Policy: the rule
State the required outcome and who it covers. Example: only approved staff may export camera recordings.
Procedure: the steps
Explain how someone requests export access, who approves it and how access is removed.
Control: the enforcement
Give export permission to the approved role, restrict others and retain the relevant activity record.
Evidence: the check
Test with an ordinary account and an approved account. Review the results and any exceptions.
Start with one business task
Worked example
A 20-person office and warehouse
| Question | Practice answer |
|---|---|
| What needs protection? | Customer files, order processing, recorded video and restricted rooms. |
| What could go wrong? | A former worker retains access, an important system stops, or footage is shared without approval. |
| Who decides? | The business assigns an accountable owner; the MSP implements and reports agreed controls. |
| What comes first? | Inventory the relevant accounts, devices and services; close known unnecessary access; confirm a recovery route. |
Prioritize by impact and likelihood. A framework helps organize the work; it does not turn an unchecked checklist into proof of security.
Use this short policy outline
| Field | What to write |
|---|---|
| Purpose and scope | The business risk, people, systems and locations covered. |
| Required behavior | A rule people can understand and a technical team can test. |
| Owner and implementer | Who approves the policy and who operates it. |
| Exceptions | Business reason, compensating protection, approver and expiry. |
| Evidence and review | What gets checked, by whom, and when the rule is reviewed. |
Publish the approved rule where staff can find it. Explain the change, provide a reporting route and support people who get stuck. Management owns personnel decisions; the technical team enforces the approved access rules and reports exceptions.
Replace one vague rule
Rewrite “only trusted people can see recordings.” Name a role, an approval step, the permissions it receives and a way to verify them.
Compare a useful answer
“The facilities owner approves named video reviewers. Reviewers may view the assigned cameras; exports require the investigator role. Administrators review membership and test an ordinary account against the export function on the agreed schedule.” Adapt the roles and schedule to the organization.
Put it into practice
Check what you learned
Choose an answer for each question, then check your understanding. Your answers stay in this browser.
Read the answers and explanations
- Only approved investigators may export recordings.
The policy states the rule. Settings implement it; a screenshot may help document it.
- Controls and tests that enforce the approved access.
A document alone does not change permissions.
- An owner, reason, protection, approval and expiry.
A recorded exception can be reviewed and closed rather than becoming an invisible permanent gap.
Sources and further reading
- NIST: CSF 2.0 for small businesses
A practical starting point for organizing security responsibilities and priorities. Our worksheets turn those ideas into a small-business exercise.
Keep your momentum
Ready for the next step?
If you can explain the example and your answer, try the next lesson. Revisit the feedback whenever you need it.
FryAVSI · Updated September 10, 2026
Reference this lesson or use a section’s direct link for a particular chart or example. How to cite an example.
FryAVSI · Northeast Ohio and beyond
Turn the learning into a working result.
Share the site, the requirement and the next step with our team.