Industry Cybersecurity & Compliance

A subcontractor may need access to client materials but may not operate under the same security controls as the primary business. Sharing links can outlast the work or reach unintended recipients. What to check Confirm contractual permissions, data sensitivity, subcontractor identity and location, access controls, MFA, storage and retention, onward...

Public Wi-Fi may be convenient but can expose traffic to hostile networks, captive portals, or impersonated access points. Business accounts remain at risk if employees ignore connection warnings or use unmanaged devices. What to check Review device encryption and updates, VPN or secure access policy, certificate warnings, file sharing settings, and...

A firewall replacement can preserve connectivity while losing security rules, VPN settings, logging, or network segmentation. A rushed cutover can also leave temporary broad rules in place. What to check Inventory current policies, VPN and remote access, public services, logging destinations, admin accounts, firmware support, and required application...

A SaaS migration can change data location, sharing defaults, audit visibility, recovery options, and administrator access. Successful file transfer alone does not confirm that the destination preserves business protections. What to check Review data classification, vendor controls, encryption, access roles, retention, deletion, export, audit logs,...

A new file-sharing platform can improve collaboration but introduce external access, data residency, retention, and audit gaps. Users may begin sharing files before business ownership and security settings are established. What to check Assess access controls, MFA, external sharing, encryption, data location, retention, audit export, backup, admin...

Production logs can contain user identifiers, internal paths, tokens, or operational details. Giving a vendor broad log access may expose more information than needed to troubleshoot a specific issue. What to check Identify required log fields, vendor identities, access duration, search and export capabilities, redaction, retention, and incident terms....

A new payment provider changes where payment data flows, who can access transaction records, how callbacks are authenticated, and which systems can issue refunds. Configuration errors can expose data or create fraud opportunities. What to check Review provider security documentation, tokenization, webhook signature validation, admin roles, refund...

A generative AI service may process prompts, files, or chat history outside the organization. Client confidentiality depends on service terms, retention, access controls, and whether data is used to improve the provider’s models. What to check Review data classification, provider retention and training settings, access controls, region, administrative...