Start a security program from scratch, in plain words
No security lead, no plan, an IT provider who does what they can. QoBot interviews you like a newly hired CISO, writes a short plan in the right order, and follows up every week.
Here's Fenwick Accounting's plan for October: three actions, about two hours in total, in this order:
- Nadia (office manager): turn on MFA for the 12 Microsoft 365 accounts · guide ready · ~45 minYour turn
- Ben (IT provider): test a restore of the shared drive · checklist sent · ~30 minYour turn
- You: approve the IT charter v1 · ~15 minNeeds you
Running the program: who does what
What QoBot does
- Interviews you about the company, tools, people, obligations and worries, one question at a time.
- Writes the picture down: your profile, your IT, what applies to you, the first risks.
- Picks the few actions that reduce the most risk for the effort, in order.
- Writes step-by-step guides for you or your IT provider, and the questions to check their work.
- Follows up each week, and re-plans after an incident, a questionnaire or a new tool.
What your team does
- Answer what only you know, in plain words: no jargon needed.
- Approve the plan, the policies and the risks you choose to accept.
- Do a few short tasks a week, or hand them to your IT provider.
Where to start
Start with a conversation, not a 200-point audit. QoBot asks about your company the way a newly hired CISO would: what you do, which tools hold your data, who has access, who your IT provider is, which customers or rules ask for security, and what worries you. It asks one question at a time, in plain words, and writes the answers into your workspace as it goes.
The result is a picture you can read: your profile, your IT as it really is, the obligations that likely apply, and the first risks, each rated in business terms (money, downtime, customers, legal exposure).
A plan you can actually do
A small company can do three things this month, not fifty. QoBot orders the actions by how much risk they remove for the effort, and gives each one:
- An owner: you, a colleague, your IT provider, or QoBot itself for the writing.
- An effort and a due date you agree to.
- An indicative cost, marked as an estimate.
- A way to check it’s done, so “done” means done.
The first actions are often the same: MFA on email and remote access, backups tested with a real restore, admin accounts cleaned up, email protection against spoofing (SPF, DKIM, DMARC), and an IT charter people actually read. QoBot confirms which ones apply to you before suggesting them.
Every week after
The program runs as a weekly follow-up: what’s done, what’s late, what changed. A new customer questionnaire, an incident, a new tool or a departure re-orders the plan. When management needs to decide something, QoBot writes a one-page note with the decisions requested.
What stays with you
You approve the plan and the policies, accept or refuse risks, and make sure the actions get done. QoBot runs the program: the expertise, the writing and the follow-up.
FAQ
We don't have an IT person. Does it still work?
Yes. QoBot writes each step for the person who will do it: you, an office manager, or an outside IT provider. For a provider, it writes the task list and the questions that check the work was done.
How much of our time does it take?
A few short tasks a week, each with a time estimate. QoBot doesn't hand you fifty actions at once: small companies can do three things this month, so it picks the three that matter most.
Will it cost money beyond the app?
Some actions do, such as a backup service or a licence upgrade. QoBot shows a cost range for each, marked as an estimate, so you decide with the numbers in front of you.
We already have an IT provider.
Good. QoBot steers and checks their work: what to ask them, what proof to request, and what a solid contract with them includes.
Sources
- Cybermalveillance.gouv.frFrench government platform: prevention guides and assistance for companiesOfficial page
- Regulation (EU) 2016/679 (GDPR), article 32EUR-Lex · security appropriate to the risk, at any company sizeOfficial text
- Directive (EU) 2022/2555 (NIS2), article 21EUR-Lex · the ten areas of a security program, a useful checklist even out of scopeOfficial text
This page explains the rules in plain words. It isn't legal advice: for a borderline case, ask a lawyer. Report an error