Before You Protect It, Identify It.
It sounds obvious. Yet how many organizations can confidently name their most important data, the systems holding it, everyone who has access—and the person responsible when something goes wrong?
Whether you’re working with the NIST Cybersecurity Framework, preparing for a SOC 2 examination, aligning with ISO 27001, or addressing HIPAA security requirements, you’ll hear different terminology. But the central questions are strikingly similar.
What matters? Where is it? Who can touch it? How is it protected? And who owns the answer?
Before adding another dashboard or drafting another policy, start with what your organization can actually identify.
Five Things to Identify Now
Think of these five areas as a practical starting point. Not a complete audit. Not a promise of compliance. A way to expose the assumptions hiding in your everyday operations.
01 · Critical Data
Know which information would hurt most if it were lost, exposed, or changed.
02 · Key Systems
Map the applications, cloud services, and devices that support essential work.
03 · Access & Accounts
Include employees, administrators, former staff, vendors, and service accounts.
04 · Controls & Gaps
See which safeguards exist, where they’re missing, and whether they work.
05 · Ownership
Name the person accountable for each important asset, control, and decision.
1. Your Critical Data: What Would You Hate to Lose?
Start with information that keeps the business operating or creates obligations when mishandled: customer records, financial information, intellectual property, personnel files, and regulated data. Where is it stored? Is it being copied into personal cloud drives or forgotten spreadsheets?
Don't assume that because a system is small, the information inside it is unimportant. Identify the data first, then consider its sensitivity and business impact.
2. Your Key Systems: What's Keeping the Lights On?
List the applications, infrastructure, cloud services, and devices that support your essential processes. Include tools purchased directly by departments, not just the ones IT manages.
Then ask what happens when one becomes unavailable. Which business processes stop? Who knows how to restore the service? A surprisingly ordinary subscription can become a critical dependency.
3. Your Users and Access: Who Can Actually Get In?
It's easy to say access is controlled. It's harder to show precisely who has it. Look at employees, contractors, vendors, privileged administrators, service accounts, and former employees whose permissions may not have been fully removed.
For critical systems, compare who should have access with who currently does. If those lists don't match, you have something worth investigating.
4. Your Controls: Are They There—and Do They Work?
Identify the protections you rely on: multifactor authentication, backups, logging, device security, patching, incident response, and vendor oversight. A policy that says something should happen is not evidence that it happens consistently.
Ask when key safeguards were last tested or reviewed. You don't need to fix every gap on the spot. You do need to know which gaps exist, and which ones could have the greatest consequences.
5. Your Owners: Whose Job Is It?
This is where perfectly reasonable security programs can come apart. A control exists. A document references it. Everyone assumes someone is handling it. But nobody can name the person responsible for maintaining or checking it.
Assign an owner for each critical asset and safeguard. Make the responsibilities specific enough to verify. “IT handles that” is a department, not an accountability model.
Turn Visibility Into Action
Here's a manageable place to begin: choose one critical business process. Document the information it uses, the applications supporting it, the people with access, the safeguards in place, and the owner of each component.
Where you can't answer a question, don't fill the blank with a guess. Mark it as an unknown and assign someone to investigate. That simple act turns an assumption into a visible risk-management task.
Frameworks can help you organize the work. But no framework can identify your systems, people, and data for you.
That's where governance begins: knowing what matters—and being able to prove you know.
The Verdyan Group
Need a clearer starting point? Explore Verdyan's $199 Security Snapshot, a focused introduction to potential gaps—not a full assessment.