Begin with what your team experiences.
This is a conversation framework, not a certification or automated security score.
People
Who gets interrupted, who owns decisions, and where access changes are most difficult?
Tools
Which systems carry daily work, and where do mail, Teams, devices, or permissions create friction?
Change
What is coming next—new hires, office changes, device replacement, migration, or growth?