Most small and mid-size companies do not lose data to sophisticated attacks. They lose it to an old password, a departed employee who still has access, or a backup nobody ever tested. Appjad (أبجد) has seen these patterns repeat across many companies, and they are fixable without a large budget. This checklist is written for owners who want to act this week, not read a policy paper.

Key takeaways

  • Access control is the fastest win: review who can reach what, and remove what is not needed.
  • A backup you have never restored is a hope, not a backup.
  • Departed employees and old vendor accounts are the most common hidden risks.
  • A one-page incident plan beats a thick document nobody opens.

First, find out who can access what

You cannot protect data you cannot see. Start with a simple inventory: every system that holds customer, financial or employee data, and every person or tool that can open it. Most owners discover accounts they forgot existed.

  1. List every system: email, accounting, CRM, file storage, website admin, cloud panels.
  2. For each system, list who has access and what role they hold.
  3. Remove or downgrade any access that is not needed for the current role.
  4. Turn on two-factor authentication for admin accounts before anything else.

Test your backup, not just your belief in it

Many companies pay for backups and assume they work. A backup is only real if someone has restored from it. Pick one critical file or system and run a restore this week. If it fails or takes days, that is exactly the finding you needed now rather than during a crisis.

  • Confirm backups run automatically, not manually on someone's to-do list.
  • Keep at least one copy outside the same server or cloud account.
  • Write down who is responsible for checking backups and how often.
  • Record how long a full restore would take for your most critical system.

Close the accounts people leave behind

Departed employees, old contractors and expired vendor accounts are the quietest risks in any company. Their logins keep working because nobody owns the offboarding step. Make account removal part of the same checklist used when someone leaves or a contract ends.

  • Deactivate accounts on the last working day, not weeks later.
  • Transfer ownership of shared logins and company social accounts before departure.
  • Keep a single master list of accounts so nothing is forgotten.
  • Review vendor and agency access quarterly and cut what is no longer active.

Set simple rules for tools that touch your data

Every software tool, integration and AI assistant your team uses is a door into company data. You do not need to block them all; you need to know they exist and set rules. Appjad applies the same principle when engineering systems for clients: define what each tool may see, what it may do, and who reviews it.

  • Approve tools before staff adopt them, and keep the approved list short.
  • For AI assistants, limit answers to information you control and review conversations regularly.
  • Give each tool the minimum access it needs, and nothing more.
  • Write down where sensitive data lives and which tools are never allowed near it.

Write a one-page incident plan

When something goes wrong, the cost multiplies with every hour of confusion. A full response framework can wait; a single page cannot. It should be short enough that any manager can act on it without calling a meeting.

  1. Define what counts as an incident: a ransomware message, a lost laptop, a leaked inbox.
  2. Name one person who leads and one alternate, with their phone numbers on the page.
  3. List the first three actions: isolate affected devices, revoke access, contact your IT provider.
  4. Decide in advance who informs customers, staff or authorities, and when.
Protection is not a product you buy once; it is a short list of habits you never stop running.

Your next step

Start tomorrow morning with the access review and one backup restore. Those two hours remove more risk than any other action on this list. If you want a second pair of eyes, Appjad can review your current setup and turn this checklist into a written plan with clear owners and dates, so data protection becomes a routine your company runs rather than a worry you carry.