Security starting plan.
Six questions about what you run, then three to five priorities with reasons, the evidence to keep, open questions and resources that fit.
Your answers stay in this browser. No account, no email, nothing sent or stored.
Based on your answers only. It does not inspect your system, score it or decide which laws apply to you.
The interactive plan needs JavaScript. Work through the same six questions on paper:
- What are you responsible for: a website, application, API, native app, internal workflow or AI system?
- How does it run, and who controls the hosting and tool accounts?
- Which categories of personal or confidential information move through it?
- Who or what can act: visitors, users, customer organizations, staff, integrations, partners, uploads?
- How is AI involved: only in building it, or in model requests, retrieval, agents or MCP connections?
- What is the next milestone: prototype, launch, client handoff, improvement, procurement or expansion?
Then write down who can do what, trace where the data goes, test the boundaries that matter most with synthetic accounts, and keep a dated record of what you checked.
Your starting plan
Based on your answers; no system inspected. This is a starting plan, not an assessment, a score or a legal determination.