Cybersecurity readiness starts with knowing what you operate.

Use this to find gaps and assign owners.

An unchecked box is a discussion to have, not a score. Write down the owner, evidence and next action for each important gap.

Cybersecurity includes office systems and the connected equipment that keeps a facility operating: cameras, VMS servers, door controllers, Wi-Fi, switches, firewalls, management consoles and third-party remote access. The risks differ, but each system needs a known owner and a maintenance path.

This checklist is organized around NIST Cybersecurity Framework 2.0’s six functions: Govern, Identify, Protect, Detect, Respond and Recover. CISA’s Cybersecurity Performance Goals offer another baseline for prioritizing practical actions. Neither framework makes this brief page a complete assessment or certification. See source notes.

Know who makes the decisions.

Evidence to ask for: owner/contact list, vendor support terms, system register and the date each was last reviewed.

List the assets you would need to secure or restore.

Unknown equipment is hard to patch and harder to recover. Start with the assets that control entry, hold sensitive data or support critical business operations.

Reduce routine paths into critical systems.

Plan updates around the equipment’s operating needs. A camera or controller firmware change may affect compatibility or availability, so confirm the vendor guidance, maintenance window and rollback plan.

Know when a control or service stops working.

Dashboards do not create response by themselves. Decide what an alert means, who gets it and how quickly the situation should be investigated.

Prepare the first hour of an incident.

Example exercise: A vendor remote-support account is suspected of compromise while a video server reports unusual activity. Who can suspend access, protect footage and authorize restoration?

Test whether the organization can return to operation.

Some cloud services handle portions of platform resilience but do not necessarily restore customer configuration, exported evidence or connected local hardware. Define the shared responsibility for each product.

Choose the first three improvements.

Record the owner, due date, evidence of completion and any accepted exception. Revisit the checklist after a major system change, incident or new location.