When a firm asks for cybersecurity, the conversation often opens on products: a new firewall, a new antivirus, a new backup brand. Those can matter. They are the wrong first sentence.
The first sentence is a data map. Write down the sets of information that would create real harm if they were published, stolen, or encrypted. For most of the organizations we sit with, that list is short: client or patient records, banking and payroll, contracts, and the email that carries all three.
What to capture
For each set, note where the live copy sits, who can open it, whether laptops hold a second copy, and whether a backup exists that is not on the same network. That page will embarrass the shared password and the “temporary” folder from 2019. Good. Those are the items a tool purchase would have missed.
Then buy, or configure, against the map
Access changes, encryption, and backup design should point at the rows on the map. Everything else can wait a quarter. A program built this way survives a new office or a new app, because the question stays the same: which row does this system belong to, and who owns it?