Cybersecurity planning: ten questions for business teams

Use these questions to structure a discussion with the people responsible for your systems. They are not a ranking of threats or an incident forecast. Priorities depend on the data, services, and business processes you need to protect.

1. How are suspicious messages verified?

The FBI warns that criminals use generative AI to make fraud more convincing, including text, images, audio, and video. Good spelling or a familiar voice is not sufficient evidence of identity. Source: FBI public service announcement, December 3, 2024: https://www.ic3.gov/PSA/2024/PSA241203

2. How are payment or account changes confirmed?

The same FBI advisory recommends verifying identity through a known contact method. Document a separate verification step for sensitive requests and make it easy for staff to pause a suspicious instruction.

3. Who can access sensitive records?

List the people and services with access, who approves it, and how access is removed when responsibilities change. Review whether each role needs the permissions it has.

4. What happens if a supplier is compromised?

Identify critical dependencies and the owner responsible for reviewing updates, security notices, and fallback options. Include AI services where they are part of the workflow.

5. Can the business restore essential services?

Identify the records and applications needed to resume operations. Ask for evidence from a restore exercise and record the gaps that still need work.

6. Which systems are exposed to the internet?

Maintain an inventory of public applications, administrative interfaces, and storage. Assign responsibility for checking configuration and responding to newly identified weaknesses.

7. How is API access checked?

Document which callers can read or change each resource. Include unauthorized requests, excessive requests, and unexpected inputs in the review plan.

8. Can unusual activity be investigated?

Agree which events need records, who reviews alerts, and how long investigation data is kept. Avoid collecting sensitive information without a defined need.

9. Who decides during an incident?

Name decision makers, escalation contacts, and communication responsibilities. Walk through a scenario where a key system or communication channel is unavailable.

10. How will priorities be revisited?

Review unresolved findings when systems, suppliers, or business requirements change. Give each action an owner and a way to check completion instead of treating a checklist as proof of security.

Use evidence to set priorities

The FBI advisory describes fraud techniques and verification precautions. The broader questions here are an editorial planning framework, not measured threat prevalence or a security certification.

Editorial revision: September 28, 2026. Review the resulting plan with the people responsible for your environment.