Every laptop and phone touching company data is encrypted and can be remotely wiped if lost or stolen.

Software and operating systems update automatically — nobody has to remember.

You know exactly how many devices and cloud accounts have access to your business data.

IT support responds and resolves issues on a written service standard, not “whenever.”

Multi-factor authentication (MFA) is required on email, banking, and any system holding client data.

Backups run automatically and have been tested with an actual restore in the last 12 months.

You have a written incident response plan — who to call, in what order, in the first hour.

Staff have been trained to spot phishing and invoice fraud in the last 12 months.

You have a written policy on what data staff can and can’t put into AI tools.

AI tools in use (ChatGPT, Copilot, etc.) run on business accounts, not personal logins.

Client-confidential data is never pasted into a public AI tool.

Someone owns AI governance as a real responsibility, not an afterthought.