Lock the Doors: AI Security Basics for a Small Office · Lesson 7 of 7

Capstone: your 10-minute weekly check

15 minutes. Set it up once. Keep it every week.

---

You've done the heavy lifting. You have a Front-Door List with an owner and an update routine on every row, computers with trimmed permissions, connectors on read-only or approval, MFA on the accounts that matter, a decision on every unofficial AI tool, and a call-back rule your team has heard from you.

None of that stays true by itself. Settings drift, new tools show up, someone clicks "Allow." This capstone turns everything into one short weekly habit, plus a set of questions for your IT partner so the parts you don't do yourself are covered too.

If your IT partner (or one of your staff) does the hands-on updates for the front-door items that can't update themselves, your part is the 10-minute check below. If you do those updates yourself, give the routine more time: the Insider article [Attackers Now Move in a Day](https://appliedaiinsider.com/articles/patch-window-one-day) suggests fifteen minutes every Monday for those devices, on top of this check. Either way, the rhythm is weekly, not monthly.

Pick a day and time you're usually at your desk. Monday morning works for most people. Create a recurring 10-minute event called "Weekly door check" and put a link to your Front-Door List in it.

Do these in order. Write the date and your initials at the bottom of your Front-Door List when you're done.

• Front doors (2 minutes). For each row in Part 1, confirm the update routine happened. If your IT partner owns it, look for their weekly confirmation. If something shows "update available," either install it or ask the owner when it's going in. Critical fixes on internet-facing systems go in within days, not at the next maintenance window.
• Known attacks (1 minute). CISA, the US cybersecurity agency, keeps a free public list of flaws attackers are actually using, called the Known Exploited Vulnerabilities catalog, and you can subscribe to email updates from its page. Skim this week's additions for any brand on your Front-Door List. If your IT partner already watches it, just ask: "Anything on the list match us this week?"
• Computers (2 minutes). On your own computer, confirm updates aren't paused (Windows Update, or Software Update on a Mac). Pick one other computer and do the same. Next week, pick a different one. Every so often, reopen Privacy & Security (Mac) or the AI app's permission settings (Windows) and make sure nothing new got Full Disk Access or file access.
• Connections (2 minutes). Open one connected-apps list: your Google or Microsoft account page, or the company-wide list from your admin. Anything new with AI in it? If it's not on your Front-Door List, it goes into Part 3 and gets a decision.
• People (2 minutes). Ask the team two questions, in person or in your group chat: "Anyone start using a new AI tool this week?" and "Anyone get an odd request for money, data or a payment change?" Thank anyone who says yes.
• Write it down (1 minute). Date, initials, and one line on anything you found or handed off.

If you find nothing, that's a good week. Write "nothing found" and close the list. The point is that you looked.

If you have an IT partner, send them this today, along with your Front-Door List and Computer Permission Check:

> We've written down every internet-facing system and AI tool we use (attached). Can you answer these? > > 1. Which of our systems can be reached from the internet, and who updates each one? Anything missing from our list? > 2. How many days, typically, between a critical fix being released and it being installed here? > 3. Do you watch CISA's Known Exploited Vulnerabilities list, and how fast will you tell us when something on it matches our list? > 4. Is the remote access tool you use to reach our computers on the latest version today? > 5. Do you know about every AI tool running on our computers and cloud accounts, and are they on the same update schedule as everything else? > 6. Is MFA on for every admin account and every account our AI tools connect to? Are we using Microsoft's security defaults, Conditional Access, or the Google Workspace equivalent? > 7. Can you send us, once a month, the list of outside apps with access to our company email and files?

Good answers are specific: names, days, versions. A vague answer isn't a crisis, but it's a reason for a follow-up conversation.

If you don't have an IT partner, you are the IT partner for these questions. Answer them yourself on the back of your Front-Door List. Anything you can't answer is the first thing to find help with.

Use this list. Every box should be ticked:

• [ ] Your Front-Door List names every internet-facing system and every AI tool, each with an owner and an update routine. Nothing says "monthly."
• [ ] Automatic updates are on for every computer, browser, phone and website plugin where they exist.
• [ ] Every computer has a row in the Computer Permission Check, and no AI app has Full Disk Access or broad file access without a reason.
• [ ] Every connector and agent is read-only or needs approval for anything that sends, pays or deletes. You've used an off switch at least once.
• [ ] MFA is on for every admin account and every account an AI tool connects to.
• [ ] Every unofficial AI tool you found has a decision and a date.
• [ ] The Call-Back Rule Card is printed or posted, and your team has heard it from you.
• [ ] "Weekly door check" is on your calendar, recurring.
• [ ] Your IT partner has the questions above, or you've answered them yourself.

You started this course with a vague feeling that AI changed something about keeping the office safe. Now you know what changed (the window is about a day, and AI tools are on the list), and you have a short set of habits that keep up with it. You didn't buy anything. You wrote things down, flipped some switches, and set a 10-minute appointment with yourself.

Next steps, when you're ready:

• Write Your Team's AI Rules in an Afternoon to fold the call-back rule, the "no file access without approval" rule and your tool list into one page for staff.
• Connect Your AI to Your Business Tools when you want your assistant to do real work in your email, files and business apps, with these habits already in place.
• Answer Customers Faster with AI and Save Your Best Instructions: Projects, GPTs and Skills for the productive side of everything you just made safe.

Previous: Fakes, cloned voices and the call-back rule · Back to the course