Back to lesson

Day-Zero Startup IT Assessment

Slide 1: Day-Zero Startup IT Assessment

On-screen

Day-Zero Startup IT Assessment

Make the first 48 hours intentional

Narration

Anna: The first forty-eight hours of a company's IT estate get set by accident. Someone signs up for something with a personal email, and five years later that account still owns the domain.
Greg: So the point of a day-zero assessment is to make those choices on purpose while there are only a handful of them.
Anna: We'll walk the checklist: what you own, where the workloads live, what you can afford to control now, and the traps that catch nearly everyone.
Greg: None of it is expensive at this stage. All of it is expensive later.

Slide 2: Why a day-zero checklist?

On-screen

Why a day-zero checklist?

  • Founders are wiring payroll, domains and devices while investors expect security by default.
  • Early missteps compound: a shared admin login today becomes a breach notification tomorrow.
  • For instance, that shared “admin123” password for your accounting software that “everyone knows” becomes a $50K breach notification when a disgruntled contractor uses it six months after leaving.
  • A structured checklist turns tribal knowledge into a repeatable onboarding ritual for every new hire and contractor.
  • It also creates a baseline for MSP handovers, cyber insurance applications and due diligence conversations.

Narration

Anna: [energetic] Before the first hire signs their offer letter, founders are already juggling payroll, domains and customer trials.
Greg: Right, and every shortcut we take with accounts or laptops in those first 48 hours becomes technical debt that haunts us like a badly written contract with your co-founder's cousin.
Anna: That is why we open with a day-zero checklist—it freezes the chaos long enough to get intentional about who can touch what.
Greg: And once it exists, you can run the same play every time a new teammate or contractor joins instead of improvising access in Slack DMs.

Slide 3: Facilitating the workshop

On-screen

Facilitating the workshop

  • Schedule a 90-minute working session with the founding team, operations lead and any fractional IT partner.
  • Start with a current-state mural or whiteboard of systems before diving into controls—people grasp context first.
  • Assign a scribe who updates the checklist live so decisions turn into action items instead of hallway promises.
  • Close each section by capturing blockers, owners and due dates to feed your task tracker that same afternoon.

Narration

Anna: [practical] When you run the workshop, block 90 minutes and invite the people who actually flip the switches—founders, ops, any MSP partner.
Greg: I like to start by drawing the current system map on a whiteboard. Seeing payroll tied to the bank, CRM feeding support, it grounds the conversation.
Anna: Then nominate a scribe. Someone updates the checklist in real time so “we should enable MFA” instantly becomes an owner plus due date.
Greg: And before you move on, pause to log blockers—missing licenses, unclear vendor contacts—so they don't end up in the startup graveyard of “we really should get around to that someday.”

Slide 4: Checklist structure at a glance

On-screen

Checklist structure at a glance

  • Identity – who has access, how accounts are created, and where MFA is enforced.
  • Endpoints – device inventory, hardening steps and remote wipe readiness.
  • Backups & Continuity – what data is protected, tested restores and manual fallbacks.
  • Security & Governance – logging, password policies, vendor reviews and incident contacts.
  • Each block should score readiness (green/amber/red) to signal where to focus limited time and budget.

Narration

Anna: [guiding] The checklist itself is four blocks: identity, endpoints, backups and security governance.
Greg: Give each line item a simple green, amber, red score. It keeps the conversation focused on risk instead of blame.
Anna: And remember to jot the system of record beside each control—Google Workspace, Okta, a password manager—so you know where truth lives.
Greg: That clarity also helps when you hand the assessment to a fractional CTO or MSP; they can instantly see the hotspots.

Slide 5: Identity foundations

On-screen

Identity foundations

  • Map every system to an identity source: HR roster, Google Workspace, Microsoft 365, or a password manager.
  • Require MFA on admin, finance and customer data tools before inviting the next hire.
  • Picture this: your sales director leaves on Friday afternoon. Without documented processes, their Salesforce admin access, Slack ownership of customer channels, and shared Dropbox folders remain active over the weekend.
  • Document joiner/mover/leaver steps, including who revokes access when someone exits suddenly.
  • Capture shared secrets in a vault with rotation dates rather than in spreadsheets or chat threads.
  • Flag gaps like personal email accounts on vendor contracts so legal can renegotiate early.

Narration

Anna: [focused] Identity is first because every other control depends on who can log in where.
Greg: Map each tool back to your source of truth—HR roster, Google, Microsoft—and note whether MFA is enforced or still optional.
Anna: Document the joiner, mover, leaver steps including who removes access at 5pm when someone resigns abruptly.
Greg: And wherever you see shared logins or personal emails on vendor accounts, highlight them for legal to renegotiate before renewal.

Slide 6: Endpoint readiness

On-screen

Endpoint readiness

  • Build an asset list with owner, device type, OS version, and last patch date—spreadsheets beat wishful thinking.
  • Standardise baseline builds: disk encryption, auto-lock timers, and approved software images.
  • Enable remote wipe or MDM for laptops and mobile phones before a travel-heavy sales push.
  • Confirm antivirus/EDR coverage and define how alerts route to whoever is on-call.
  • Note loaner device processes so day-one hires are not waiting on procurement.

Narration

Anna: [methodical] Endpoints are next. Start with a live asset list—owner, device type, OS version, last patch date.
Greg: It can be a spreadsheet to begin with, just make sure someone owns keeping it current.
Anna: Record your baseline build: encryption on, screen lock, approved software. Consistency stops shadow IT before it spreads.
Greg: And check you can remote wipe or at least lock a laptop. Founders travel, gear gets left in rideshares, and suddenly your company's most sensitive data is racing through downtown in someone else's Tesla.

Slide 7: Backups and data protection

On-screen

Backups and data protection

  • Identify critical data stores: source code, CRM, finance, shared drives and product telemetry.
  • Verify at least one automated backup exists with retention that meets contractual promises.
  • One startup lost three months of customer support tickets when their help desk vendor had a data center fire. They assumed “it’s SaaS, they handle backups” until the fine print said otherwise.
  • Test a sample restore quarterly and document who validated it, how long it took and what broke.
  • Outline manual fallback workflows—exporting CSVs, printing key documents, or switching to a secondary tool.
  • Track compliance drivers (tax, privacy, contracts) that dictate how long data must stay recoverable.

Narration

Anna: [analytical] For backups, identify the data that would hurt to lose—source code, CRM, finance, product telemetry.
Greg: Ask two questions: is there an automated backup, and when did we last test restoring it?
Anna: Capture how long the restore took and any surprises. That anecdote becomes gold when auditors or investors ask about resilience.
Greg: Also plan manual fallbacks—exporting CSVs, printing key docs—so the team can keep shipping even while a vendor is down.

Slide 8: Cloud-first vs. hybrid realities

On-screen

Cloud-first vs. hybrid realities

  • Catalogue where workloads actually live: fully managed SaaS, cloud-native infrastructure or a closet server humming beside the coffee machine.
  • Cloud-first startups lean on identity providers and vendor assurances—validate export options and incident SLAs.
  • Hybrid environments demand network diagrams, VPN policies and clear ownership for patching on-prem gear.
  • Flag data residency constraints early; some investors or customers will demand proof of where data rests.

Narration

Anna: Start by cataloguing where workloads genuinely live. Fully managed SaaS, cloud-native infrastructure, or a server humming quietly next to the coffee machine.
Greg: That third category exists more often than founders admit, and it never appears on the architecture diagram.
Anna: Cloud-first companies lean heavily on an identity provider and on vendor assurances, so validate the export options and the incident response commitments rather than assuming them.
Greg: Hybrid setups need network diagrams, VPN policies, and a named owner for patching the on-premise gear.
Anna: And flag data residency early. Investors and enterprise customers will eventually ask you to prove where data rests.

Slide 9: Budget reality check

On-screen

Budget reality check

  • Triage controls by risk and runway: what must be solved with $500/month versus what waits for a $5K allocation.
  • Highlight quick wins—enforcing MFA, password managers, baseline device hardening—before pricier SIEMs or MDR contracts.
  • Map spend to milestones (Series A, first enterprise customer) so finance understands why costs jump.
  • Capture deferred items with explicit triggers: “Upgrade logging when monthly recurring revenue hits $250K.”

Narration

Anna: Triage controls against risk and runway. What has to be solved on five hundred dollars a month, and what waits until there's a five thousand dollar allocation?
Greg: The quick wins come first, and they're cheap: enforcing MFA, a password manager, baseline device hardening. Those buy more risk reduction per dollar than anything else.
Anna: The expensive tooling, SIEM platforms, managed detection contracts, can wait for a real trigger.
Greg: Map the spend to milestones so finance understands why the cost steps up at Series A or at the first enterprise customer.
Anna: And record deferred items with explicit triggers. Upgrade logging when recurring revenue hits two hundred and fifty thousand.

Slide 10: Common day-zero pitfalls

On-screen

Common day-zero pitfalls

  • Relying on personal Gmail accounts for vendor contracts and Stripe access.
  • Skipping device encryption because “it’s just a prototype laptop.”
  • Assuming vendors manage backups, incident response or compliance obligations without written proof.
  • Forgetting to offboard contractors, leaving privileged accounts active for months.
  • Treating security tasks as “best effort,” so they die in the backlog when sales gets hectic.

Narration

Anna: The recurring ones are almost boringly consistent. Personal Gmail accounts holding vendor contracts and Stripe access.
Greg: Skipping device encryption because it's just a prototype laptop, right up until the prototype laptop is stolen.
Anna: Assuming the vendor handles backups, incident response and compliance obligations, without anything in writing that says so.
Greg: Forgetting to offboard contractors, so privileged accounts stay live for months after the work ended.
Anna: And treating security work as best effort, which means it dies in the backlog the first week sales gets busy.
Greg: Each one is a five-minute fix on day zero and a project by year two.

Slide 11: Vendor due diligence quick wins

On-screen

Vendor due diligence quick wins

  • Create a lightweight intake form covering data stored, access model, compliance attestations and breach history.
  • Ask for security documentation (SOC 2, pen test summary) before signing, not after the renewal.
  • Verify termination clauses: how fast can you retrieve or purge data when the contract ends?
  • Add vendors to your asset and identity maps so joiner/leaver workflows catch shared integrations.
  • Keep a template questionnaire email ready to send the moment a new tool is proposed.

Narration

Anna: You don't need a procurement function to do this well. A lightweight intake form covers most of it: what data the tool stores, how access works, which compliance attestations exist, and whether they've had a breach.
Greg: Ask for the security documentation before signing, not at renewal when your leverage is gone.
Anna: Check the termination clause specifically for how fast you can retrieve or purge data when the contract ends.
Greg: Then add the vendor to your asset and identity maps, so joiner and leaver workflows catch shared integrations rather than missing them.
Anna: Keep the questionnaire drafted and ready, so it goes out the moment someone proposes a new tool.

Slide 12: Security controls and monitoring

On-screen

Security controls and monitoring

  • Review password policies, SSO coverage and whether default admin accounts have been renamed or disabled.
  • Confirm logging is enabled for auth events, financial transactions and production infrastructure.
  • Establish an incident contact tree with who calls legal, PR, investors and affected customers.
  • Set expectations for vulnerability scanning cadence and patch response windows.
  • Capture third-party vendor attestations (SOC 2, ISO 27001) and note renewals on the calendar.

Narration

Anna: [cautious] The security and monitoring section ties everything together.
Greg: Review password policies, make sure default admin accounts are renamed, and log authentication events somewhere you can actually search.
Anna: Draft an incident contact tree now—who talks to investors, customers, regulators—so you are not scrambling mid-crisis.
Greg: And decide on vulnerability scanning cadence plus patch windows; expectations set early are easier to enforce later.

Slide 13: Workshop outputs

On-screen

Workshop outputs

  • A scored checklist PDF or Notion page with red/amber/green status and named owners.
  • A 30/60/90-day roadmap of remediation tasks aligned to risk and business milestones.
  • Updated runbooks: account lifecycle, device setup, backup testing and escalation paths.
  • Template email scripts for vendor security questionnaires and customer assurances.
  • Starter policy templates (access control, device, incident response) ready for quick customization.
  • Quick-reference cards for emergency procedures—lost device, suspected phishing, production outage.
  • A shared folder with evidence—screenshots, policy links, vendor contracts—for future audits or funding rounds.
  • A follow-up session booked to review progress before the next hire or investor meeting.

Narration

Anna: [outcome-focused] By the end of the workshop you should have tangible outputs, not just a lively chat.
Greg: That means a scored checklist, a 30/60/90 plan, refreshed runbooks and a folder of evidence screenshots and policies.
Anna: Book the follow-up review before everyone leaves the room—ideally before the next hire or investor update.
Greg: Treat it like any other deliverable: assign owners, due dates, and drop the tasks into your project tracker right away.

Slide 14: Roles, traits and progression

On-screen

Roles, traits and progression

  • Day-zero assessments are often led by fractional CTOs, security-minded operations managers or MSP onboarding leads.
  • Junior security analysts and IT generalists can shadow to learn stakeholder facilitation and control baselining.
  • Success hinges on curiosity, diplomacy and the ability to translate checkboxes into founder-friendly language.
  • As the company scales, these practitioners grow into heads of IT, risk leaders or customer trust advocates with board visibility.
  • Encourage cross-functional allies—finance, HR, product—to own portions of the checklist so accountability is shared.

Narration

Anna: [career-minded] These assessments are often championed by fractional CTOs, security-savvy ops managers or MSP onboarding leads.
Greg: It is a fantastic shadowing opportunity for junior analysts—they learn facilitation, stakeholder translation and control baselining.
Anna: The real skill is empathy: explaining why MFA matters without sounding like the “no” police.
Greg: Nail that and you build the muscle to grow into head of IT, risk lead or customer trust advocate roles as the company scales.

Slide 15: Key takeaway

On-screen

Key takeaway

A living day-zero checklist is your startup's safety net. It keeps identity, devices, backups and security posture honest from the outset, making future audits and incidents far less dramatic.

Treat the artefact as a shared playbook: iterate after every hire, vendor change or funding round so resilience matures alongside revenue.

Narration

Anna: [encouraging] Keep the checklist alive; review it after every hire, vendor change or funding milestone.
Greg: When investors or auditors call, you already have evidence folders and owners lined up—it shifts the tone from defensive to confident.
Anna: More importantly, the team knows what “secure enough” looks like today and how it will mature tomorrow.
Greg: That shared playbook turns day-zero chaos into a calm, repeatable ritual that protects both momentum and trust.