Our company
Prepared Nov 4, 2026 from the Security Essentials checklist. Tier: 20 to 99 employees (Texas SB 2610 tier 2). 0 of 16 safeguards in place.
1. Purpose and scope
This program describes the administrative, technical, and physical safeguards the company uses to protect the personal and confidential information it holds, sized to a company of 20 to 99 employees. It is built on the Center for Internet Security Controls, Implementation Group 1, and is reviewed at least annually and after any significant incident.
2. Roles
A named owner is accountable for this program and reports to the business owner. Every safeguard below has an owner, recorded in the workspace. Staff are trained on the parts that apply to them when they join and at least once a year.
3. Safeguards
| ID | Safeguard | What we do | Status |
|---|---|---|---|
| S1 | Know your devices CIS 1.1, 1.2 | Keep a current list of every laptop, phone, server, and network device, and remove unknown ones. | Not assessed |
| S2 | Know your software CIS 2.1, 2.2, 2.3 | Keep a list of the software and SaaS in use; remove what is unsupported or unapproved. | Not assessed |
| S3 | Protect data by classification CIS 3.1 to 3.6 | Know which data is sensitive, where it lives, who can access it, how long it is kept, and encrypt it on devices and removable media. | Not assessed |
| S4 | Secure configurations CIS 4.1 to 4.7 | Set devices, cloud accounts, and network gear to secure defaults, lock screens, and change default passwords. | Not assessed |
| S5 | Manage accounts CIS 5.1 to 5.4 | Keep an inventory of accounts, use unique passwords, disable dormant accounts, and separate admin accounts from daily use. | Not assessed |
| S6 | Control access and use MFA CIS 6.1 to 6.5 | Grant and revoke access through a process; require multi-factor authentication for external applications, remote access, and all administrator accounts. | Not assessed |
| S7 | Patch continuously CIS 7.1 to 7.4 | Run automated updates for operating systems and applications and fix known vulnerabilities on a schedule. | Not assessed |
| S8 | Keep audit logs CIS 8.1 to 8.3 | Collect and keep logs from systems and cloud services, with time synchronized. | Not assessed |
| S9 | Protect email and browsers CIS 9.1, 9.2 | Use supported browsers and email clients, filter malicious links and attachments, and publish SPF, DKIM, and DMARC. | Not assessed |
| S10 | Defend against malware CIS 10.1 to 10.3 | Run and update endpoint protection on all devices; disable autorun. | Not assessed |
| S11 | Back up and test restores CIS 11.1 to 11.4 | Automate backups, keep a copy separate from the network, protect it, and test restores. | Not assessed |
| S12 | Manage the network CIS 12.1 | Keep network equipment supported and updated; segment guest and business networks. | Not assessed |
| S13 | Train people CIS 14.1 to 14.8 | Run security awareness training at hire and yearly, covering phishing, deepfake fraud, passwords, data handling, and reporting. | Not assessed |
| S14 | Manage service providers CIS 15.1 | Keep an inventory of providers that hold your data or run critical systems, with contracts that cover security. | Not assessed |
| S15 | Respond to incidents CIS 17.1 to 17.3 | Name who handles incidents, keep contact lists, and define how staff report suspicious activity. | Not assessed |
| S16 | Secure AI tools CIS AI-specific (Commons addition) | Approve AI tools before use, set their data settings, keep company data out of unapproved tools, and test customer-facing AI for prompt injection and data leakage. | Not assessed |
4. Remediation plan
- S1 Know your devices: owner and target date to be assigned.
- S2 Know your software: owner and target date to be assigned.
- S3 Protect data by classification: owner and target date to be assigned.
- S4 Secure configurations: owner and target date to be assigned.
- S5 Manage accounts: owner and target date to be assigned.
- S6 Control access and use MFA: owner and target date to be assigned.
- S7 Patch continuously: owner and target date to be assigned.
- S8 Keep audit logs: owner and target date to be assigned.
- S9 Protect email and browsers: owner and target date to be assigned.
- S10 Defend against malware: owner and target date to be assigned.
- S11 Back up and test restores: owner and target date to be assigned.
- S12 Manage the network: owner and target date to be assigned.
- S13 Train people: owner and target date to be assigned.
- S14 Manage service providers: owner and target date to be assigned.
- S15 Respond to incidents: owner and target date to be assigned.
- S16 Secure AI tools: owner and target date to be assigned.
Incident response
Suspected incidents are reported to the program owner immediately. The first 24 hours follow the Commons Incident Desk playbooks, and notification duties are checked for every jurisdiction where affected people live.
Generated by AI Governance Commons from the company's own answers. It documents a program; it is not a certification, an audit, or legal advice, and it does not by itself establish eligibility for any statutory safe harbor.