Security for Teams: risk reviews and incident plans

01

From "me" to "us": owner, scope and assets

In simple words

When you live alone, you lock your own door. When eight people share a house, someone must know where all the keys are, which windows open, and what is most precious. Team security starts with one person in charge and a list of what you are protecting.

Before this course: Security in Practice: accounts, devices and backups (course 7.8.2). You can already audit your own accounts, use strong MFA, harden devices and a router, test backups and write a personal recovery plan. Now you protect a team: many people, shared accounts, customer data and suppliers. We will use one example all course: "Harbour Bakery", an imagined bakery with 8 staff, an online order form, a card terminal, a shared email inbox and a laptop for accounts.

Key facts

The NIST Cybersecurity Framework (CSF) 2.0, released on 26 February 2024, is designed for organizations of any size, including small businesses. It has six core functions: Govern, Identify, Protect, Detect, Respond, Recover. Govern is new in 2.0: it treats cybersecurity as a business risk that leaders decide on, like financial risk.
The Cyber Centre's baseline controls for small and medium organizations start with steps you can copy:
Name a leader responsible for IT security, and track what you spend on it.
Scope your systems: list all computers, devices, applications and cloud services you use, including contracted ones.
Rate how much each asset matters: how bad it would be if it were seen by the wrong people (confidentiality), changed or broken (integrity), or unavailable (availability).
An asset is anything worth protecting: data (customer list, recipes, payroll), devices (laptop, phones, card terminal), accounts (email, bank, website admin), services (online ordering, cloud storage) and people's knowledge.
Do not forget suppliers: website hosts, payment providers, IT helpers and cloud services hold your data or keys too.
One person "owns" security, but everyone has a part. The NCSC small business guide says security should not rest with one person.

Example (part of Harbour Bakery's asset list)

Asset	Type	Who uses it	Confidentiality / Integrity / Availability matter?
Shared orders inbox	Account	3 counter staff	High / Medium / High
Accounts laptop	Device	Owner, bookkeeper	High / High / Medium
Online order form and website admin	Service	Manager	Medium / High / High
Customer email list	Data	Manager	High / Medium / Low
Bank and payment provider logins	Account	Owner	High / High / Medium

Step by step

Write the name of the security owner at the top of a new document, and a backup person.
Walk through a normal day and write every device, account, app and cloud service the team touches.
Add the suppliers who hold your data or can log in to your systems.
Group the list into data, devices, accounts and services.
For each asset, mark how much confidentiality, integrity and availability matter: High, Medium or Low.
Note who uses each asset and whether any login is shared.
Circle the five assets that would hurt most if lost, leaked or broken.
Check: a new staff member could read the list and know what matters most and who is in charge.

Watch on YouTube

NIST CSF 2.0 for small business, explained in 10 minutesHailBytes · YouTube · youtube.com

Videos by other creators on YouTube, for reference. They are not made by or affiliated with The Future Market.

LESSON 01From "me" to "us": owner, scope and assets

LESSON 01 / ANIMATED LESSON / AI VOICE00:00 / 01:00

Voice

Read the video script

[Host] "Alone, you lock your own door. In a team, someone has to know where every key is."
[Text on screen: Govern, Identify, Protect, Detect, Respond, Recover] "NIST's framework has six functions. Govern comes first: someone owns security and leaders make the decisions."
[Screen: asset list table with High, Medium, Low] "Then list what you protect: data, devices, accounts, services and suppliers."
[Host] "Circle your top five. That is where you start."

Try it now

Make the asset list for a real or imagined small team (at least 12 assets, including two suppliers). Name the security owner and a backup, and circle your top five assets.

ClaudeStuck? Copy a ready-made prompt for Claude

Copy this, open Claude, paste it, and Claude will walk you through the lesson step by step.

For a grown-up: Claude is for adults (18+). Copy this, paste it into Claude, and use the answer to explain the lesson to your child.

I'm learning "Security for Teams: risk reviews and incident plans" on The Future Market. Lesson 1: "From "me" to "us": owner, scope and assets".

What the lesson teaches:
- The NIST Cybersecurity Framework (CSF) 2.0, released on 26 February 2024, is designed for organizations of any size, including small businesses. It has six core functions: Govern, Identify, Protect, Detect, Respond, Recover. Govern is new in 2.0: it treats cybersecurity as a business risk that leaders decide on, like financial risk.
- The Cyber Centre's baseline controls for small and medium organizations start with steps you can copy:
- Name a leader responsible for IT security, and track what you spend on it.
- Scope your systems: list all computers, devices, applications and cloud services you use, including contracted ones.
- Rate how much each asset matters: how bad it would be if it were seen by the wrong people (confidentiality), changed or broken (integrity), or unavailable (availability).
- An asset is anything worth protecting: data (customer list, recipes, payroll), devices (laptop, phones, card terminal), accounts (email, bank, website admin), services (online ordering, cloud storage) and people's knowledge.
- Do not forget suppliers: website hosts, payment providers, IT helpers and cloud services hold your data or keys too.

The exercise I'm working on:
Make the asset list for a real or imagined small team (at least 12 assets, including two suppliers). Name the security owner and a backup, and circle your top five assets.

I'm stuck. Please:
1. Explain the main idea in plain, simple words with one everyday example.
2. Walk me through the exercise one small step at a time. Ask me what I've done so far before giving the next step.
3. Don't just give me the final answer. Help me do it myself, and check my work when I share it.

I'm a parent helping my child (about 8 years old) with a lesson called "From "me" to "us": owner, scope and assets" from the course "Security for Teams: risk reviews and incident plans".

Here's what the lesson says:
When you live alone, you lock your own door. When eight people share a house, someone must know where all the keys are, which windows open, and what is most precious. Team security starts with one person in charge and a list of what you are protecting.

The activity:
Make the asset list for a real or imagined small team (at least 12 assets, including two suppliers). Name the security owner and a backup, and circle your top five assets.

Please explain this so an 8-year-old understands: short sentences, a fun everyday example, and no hard words.
Then give me 3 simple questions I can ask my child to check they understood, and a way to do the activity together, one tiny step at a time.

Open Claude

Sources

NIST, CSF 2.0 release announcement: www.nist.gov/news-events/news/2024/02/nist-releases-version-20-landmar
Canadian Centre for Cyber Security, baseline cyber security controls for small and medium organizations: www.cyber.gc.ca/en/guidance/baseline-cyber-security-controls-small-and
NCSC, small business guide: www.ncsc.gov.uk/collection/small-business-guide

My notes

I learned this

02