The 5 Security Questions a Founder Should Be Able to Answer Today

Most founders can tell you their runway to the week. Fewer can say where their customer data lives. That gap is where security trouble starts, and closing it does not take a security degree. It takes five answers.

Try these on your own, then on your team. If the answers differ between people, that is useful information too.

1. Where does our important data live?

Name the systems that hold customer records, financials, source code and employee information. Include the ones nobody planned: spreadsheets exported to a laptop, shared drives, tools a team signed up for with a company card.

A good answer: a short written list, with one named owner per system. A warning sign: "I think it's mostly in our main platform."

2. Who can get in, and could we remove them quickly?

Think about employees, contractors, former staff and vendors. Ask how long it would take to cut off someone's access to everything on the day they leave.

A good answer: one place that shows who has access to what, and a leaving checklist that gets used. A warning sign: shared logins, or access that survives after a role changes.

3. What happens if it breaks?

Pick a bad day: a laptop is stolen, a vendor goes down, or someone clicks a link they should not have. What is the first thing that happens, and who is doing it?

A good answer: backups exist, someone has tried restoring from them, and people know the first step. A backup you have never restored is a hope, not a plan.

4. Who do we call?

When something goes wrong at 9 p.m., who makes decisions, who talks to customers and who do you bring in for outside help? Write the names and numbers down somewhere you can reach even if your email is down.

A good answer: a one-page contact and decision list that people can find. If you need outside help leading this work, our guide to when a company needs a fractional CISO explains what that support should deliver.

5. What have we promised customers?

Look at contracts, security questionnaires, your website and sales emails. Whatever you have said about how you protect data, you are now expected to do. Promises made in a hurry by sales are still promises.

A good answer: someone has read what you have told customers and checked it against what you actually do. Where the two differ, either fix the practice or fix the claim.

What to do with your answers

Do not try to fix everything this week. Pick the answer you are least comfortable with and give it one owner and one date. Then come back to the list next month.

If the questions turn up cloud accounts nobody can account for, start by adding them to the list from question 1 with a named owner each. You cannot protect what nobody has written down.