FlintScope ← Module 1 overview

Free course · Module 1 · Lesson 3 of 4

What would hurt most

About 12 minutes · fills in: Part 3, our top systems

What you'll decide

Which three to five systems your business protects first, who's responsible for each, and how that list sets the order for everything that isn't an emergency.

The gate from Lesson 2 catches the fires. Most of your list won't be fires. It'll be a long middle of Box 2 and Box 3 items, and your IT provider still needs to know which to do first.

The tiebreaker is the third question: what would it hurt? A flaw on the laptop that runs payroll and the same flaw on the break-room PC are the same flaw. They aren't the same risk.

Plain-English terms

System. Anything your business runs on: a service like Microsoft 365 or QuickBooks, a device like the card reader, or a machine like the payroll laptop.

Touches. A problem touches a system if it's on that system, or on a device people use to log in to it. The laptop your bookkeeper uses for online banking touches your bank account.

Owner (of a system). The person inside the business who answers for it: decides who gets access, notices when it's down. Not necessarily the person who fixes it.

Four kinds of hurt

For a small business, serious damage almost always comes through one of four doors.

Money that moves

Your bank account, payroll, QuickBooks, and card processing. This is where losses turn up as actual dollars: a changed direct-deposit account, a fake vendor invoice that gets paid, a transfer nobody authorized.

Email

It gets its own line because it opens everything else. Password resets for almost every other account go to email. Whoever controls your email can reset their way into the bank, the payroll service, and the store. It's also where fake-invoice scams start.

Customer data

Names, addresses, card details, health or account information. If it leaks, every U.S. state has a law that can require you to send notification letters, and your customers remember getting one.

The thing you can't open without

The card reader, the booking system, the online store, the machine that runs the production line. If it's down, you're closed. Every day closed is a day of revenue gone.

Most businesses have one or two systems in each category. Your top systems list is the three to five that matter most across all four.

How the list sets the order

Each box has a level, and your top systems list can move a problem up one:

  1. Box 1 (Fire) is always P1. Lesson 2's gate doesn't care what the system is.
  2. Otherwise, Box 2 is P2, Box 3 is P3, and Box 4 is P4.
  3. A top system moves it up one level. A Box 2 problem on the payroll laptop becomes P1. A Box 3 problem on the online store becomes P2. The same Box 3 problem on the brochure website stays P3.
  4. Work the levels in order, P1 first. Inside a level, anything on a top system goes first, then the higher severity score. This is where the score from Lesson 1 finally earns its place.

That's the whole method. Lesson 4 puts a deadline on each level. The VM Program Kit's model does the same thing with a scoring formula across up to 2,000 findings. For a list of forty, the four steps above will get you to the same order.

Writing the list

For each top system, write three things:

Keep it to five. If everything is on the list, the list can't tell your IT provider what to do first, which is its whole job.

Scenario

Two fixes this month

Your IT provider has hours for two more fixes this month. None of these is a Fire. Which two?

Pick the one you would choose. It opens with the reasoning, then you can compare the rest.

AA and B. They're both being exploited.

Being exploited puts both in Box 2, but B touches nothing that matters: no money, no email, no customer data. A touches payroll and the bank, so it moves up to P1. B stays P2. D is also P2, because reachable from the internet and holding customer data moves it up from Box 3. Between two P2 items, the one on a top system goes first, so D comes before B. B can wait for the next round.

BA and D.
Best answer

A is Box 2 on a top system, so it's P1, the highest item on the list. D is Box 3 on a top system (customer data), so it's P2. B has the same flaw as A but touches nothing important, so it stays P2, and between two P2 items the one on a top system goes first. C has the biggest score on the list, but the site holds nothing, so it's P3 and the score doesn't move it ahead of D.

CC and D. Both can be reached from the internet.

Both are Box 3, and only D touches a top system. But A is Box 2 on the machine that runs payroll, so it's P1 and comes before either of them. And between C and D, D holds customer data while C holds nothing, even though C scores higher.

DWhichever two are quickest.

Doing quick fixes first feels good and moves the count, and it's how the payroll laptop stays unfixed for a year. Speed is a fair tiebreaker between two items of equal risk. It isn't a way to set the order.

Remember

Build your file

Part 3: Our top systems

In Part 3 of your file, list three to five systems. For each one: what breaks, who owns it, who fixes it. Put email on the list unless you have a very good reason not to. Delete any rows you don't use.

Example, for a 14-person bakery-café:

System What breaks Owner Fixes it
Microsoft 365 email Key to every other account; invoice scams Owner IT provider
Bank and payroll Money moves Bookkeeper Bank / payroll vendor
Square (register and online orders) Can't take payment; card data Manager Square, IT provider for the iPads
Catering order system Customer names and orders; lose the week's bookings Owner Website developer