Own
your stack.

Many incidents exploit ordinary gaps: a platform nobody updated, a vendor nobody inventoried, an account nobody closed. This workbook is the boring, unglamorous list of the things that actually matter, laid out so a real team can sit at a real table and fill them in.

What you actually run.

List every system that is reachable from the internet or holds data you would hate to lose: website, intranet, CRM, file storage, email, payment tooling, anything with a login page. If a row makes you uncomfortable to fill in, that row is the finding.

“Who maintains it now” must be a person’s name, not a company and not “the agency.” If the honest answer is nobody, write nobody. That is the most valuable word on this page.

You inherit every vendor’s security.

Several recent incidents illustrate indirect vendor risk: a partner, a support platform, or a contractor’s privileged credentials. Every vendor holding your data, or holding access into your systems, is a door with your name on it. List them all, including the ones you inherited.

Who holds the keys?

Without a lifecycle process, access tends to accumulate and can survive role changes and departures. Go system by system and write down every account with administrative rights, including shared accounts, service accounts, and the ones belonging to people who no longer work here. Then decide, out loud, which ones stay.

Shared accounts (“info@”, “admin”, the social media login everyone uses) deserve their own row. They are the accounts nobody owns and everybody uses, which is the worst possible combination.

Do these in order.

Order matters. Password migrations often create avoidable confusion when people start by changing forty passwords with nowhere to put them. Set up the manager first, protect the email account second, then work outward by blast radius.

Twelve months, one page.

Patch on your schedule or on the attacker’s. Put a name and a recurring calendar entry against each month, initial the box when it is done, and keep this page where the team can see it. Set a documented cadence that fits your exposure; critical security patches do not wait for the calendar.

The settings that ship off.

Both platforms leave important protections switched off, or behind a tier you may not have bought. Work down the column for the platform you run. Console paths verified 16 August 2026; admin consoles move things, so search the setting name if a path has drifted.

Education, not legal advice. Vendor console paths and defaults change without notice; verify in your own tenant. Paths and defaults as of 16 August 2026.

Write this before you need it.

Fill this in now and keep a copy reachable when your systems are not: a wall, a wallet, a phone photo. The first hour sets the tone, and it is the worst time to start improvising.

What is already public about your kids.

This page is not about your organization. It is the one worth doing at a kitchen table, because the exposure it covers cannot be undone later: material absorbed into a trained model has no deletion request. The goal is not guilt. It is reducing what gets added from here, and closing the identity-fraud surface, which genuinely is reducible.

Under “identifiers”, look for the combination that powers child identity fraud: full legal name, birthdate, school or hospital name, street, and a clear face. Captions add identity, school, date and location context. The photo itself can also carry biometric, impersonation or exploitation risk on its own.

What actually binds you here.

Work down the column and take anything unresolved to counsel. Naming the statute turns a vague worry into a decision someone can make.

Education, not legal advice. Coverage under each statute turns on facts this table cannot establish. Several of these are weeks old. Confirm with counsel before acting.

Three sentences, and what’s actually settled.

Officers need not tell you that you may decline. Refusing alone is not suspicion (Bostick, 1991).

Know-your-rights education, not legal advice. Much of this is unsettled and none accounts for your status or jurisdiction. Talk to a lawyer.

Nine answers, and you have a policy.

In a 2025 observational survey of 48,340 people across 47 countries, policy-contravening AI use was highest where generative AI was banned outright (67%) and lowest where no policy existed at all (33%). The design does not establish why the groups differed. A rule people route around may remove your visibility rather than the behaviour. Anchors are NIST AI RMF subcategories, which are voluntary and not law.

Education, not legal advice. Two PR items are worth counsel time: unauthorized commercial or advertising use of an AI-generated or cloned likeness may fall under Ley 139-2011 as amended by Ley 163-2026, subject to consent and exceptions; and Ley 111-2005 breach notification can be triggered by credentials or employment evaluations pasted into an outside tool. As of 15 Aug 2026 we found no general cross-sector PR statute imposing AI-specific duties merely for using AI.

The settings that measurably work.

Not a full defence, and not a one-time fix. These are the changes with evidence behind them, ordered by effort. Removal in particular is maintenance: Consumer Reports found profiles reappearing weeks or months later.

Education, not legal advice. Menu paths and vendor practices change between software versions; verify on your own device. Figures as of 15 August 2026.

Ninety minutes, four times a year.

Everything in this workbook decays. Accounts accumulate, vendors change, software goes end-of-life, and the person who owned the calendar leaves. A short standing review is what turns a good week into a practice. Put it in the calendar before you close this page.