Client Security Baseline Intake (Onboarding)

Client Security Baseline Intake (Onboarding)

1. 01

   Inventory every system that touches client data before signing the engagement letter

   List the client's CMS, hosting, analytics, ad accounts, CRM, and any AI agents or automations already connected. Record who holds admin credentials for each.

2. 02

   Map the attack surface against the client's actual stack, not a generic template

   A WordPress site with three plugins and a shared host carries different exposure than a headless build on managed infrastructure. Note which components are commodity software that automated scanners now probe at scale.

3. 03

   Assign a named owner for each credential set and revoke shared logins

   Shared logins make incident attribution impossible. Move client access into per-person accounts with MFA, and store secrets in a vault rather than a shared document.

4. 04

   Scope agent and automation permissions to the minimum task requirement

   Every AI agent or integration connected to a client account should have read-only or narrowly scoped write access unless the workflow provably needs more. Document the permission grant and its justification.

5. 05

   Run a first-pass vulnerability scan on client-facing web properties and repositories

   Cover leaked credentials, dependency risks, and misconfigured access rules. Grade findings by severity and share the raw output with the client rather than a summary alone.

6. 06

   Set the liability boundary in writing before any remediation work begins

   State plainly what the retainer covers (monitoring, patching cadence, response time) and what it does not (absolute security, zero-breach guarantees). Have the client countersign.

7. 07

   Agree an incident notification window and escalation contact

   Define how fast the client hears about a suspected breach and who on their side answers at 2am. Put both names and numbers in the onboarding record.

8. 08

   Schedule the first 30-day security review on the delivery calendar

   Book the review before onboarding closes so it does not slip behind campaign work. The review checks scan deltas, permission drift, and any new tools added to the stack.