Choose a starting point for your organization, church or nonprofit, home, or defense contracting work. Connect practical priorities to useful preparation, official guides and scoped Layer8 support.
Choose a priority to explore its question, useful evidence and related resources. Add the priorities you want to discuss to a starting plan.
For the Home
Get settings, accounts and everyday decisions working together. Choose a few priorities for the phones, tablets, games and connected devices your family uses.
Layer8 can help with agreed technical setup, settings checks and a clear handover to the authorized adults. Keep family conversations, age-appropriate choices and regular check-ins alongside the technical work.
For Defense Contractors
For a software and hardware services contractor of roughly 500–750 people, start with one real project: who receives its information, where engineers use it, who supports it and how the delivery leaves the company.
Requirements follow the contracts, information and system boundaries. Federal Contract Information (FCI), Controlled Unclassified Information (CUI) and classified information need the applicable handling path. Headcount does not select a CMMC level. Use these priorities to develop the program, implement improvements and prepare evidence for the applicable reviews.
Are guest, business and sensitive systems separated as intended?
Can guest Wi-Fi, production equipment and children's check-in systems reach only what they need?
A simple dependency map gives network changes a purpose and a testable result.
Churches & nonprofits: Include classrooms, livestream and AV equipment, kiosks, guest Wi-Fi and administration. Preserve safe operations during testing.
Evidence worth preparing
A diagram of the intended networks and important service dependencies.
Named owners for networking, providers and remote administration.
An agreed validation plan with a change window, rollback and acceptance checks.
Do we know where sensitive records go and how long we keep them?
Who can view or export giving records, payment information and program participant details?
Record categories, owners and retention decisions help reduce unnecessary copies and unclear responsibility.
Churches & nonprofits: Consider giving platforms, spreadsheets, pastoral or support records, children's information and payment providers. Use synthetic examples for discovery.
Evidence worth preparing
A record-category map showing systems, exports, owners and purposes.
Role-based access and retention decisions, with an approved disposal process.
Payment-provider responsibilities and the merchant's agreed compliance scope.
What would demonstrate that an agreed safeguard works?
Can the board see the audit scope, key gaps and evidence without receiving personal records?
An agreed review plan and examples from your day-to-day work help make the assessment useful and show when it is complete.
Churches & nonprofits: Use a U.S. baseline with a California applicability discussion where relevant. Confirm obligations rather than assuming every framework applies.
Evidence worth preparing
The intended assessment boundary and decision the customer needs to make.
Named evidence owners and agreed acceptance criteria.
A gap register separating observed evidence, unknowns and planned follow-up.
Do the device and account settings fit your child’s age and your family’s decisions?
Use the correct age and an appropriate child or teen account where the service supports it. Review content restrictions, app approvals and time settings before handing over a device. Check the settings on each device and inside the apps: one control may not cover every experience.
Things to review together
The device types, account categories and adults authorized to manage them; leave birth dates, passwords and recovery codes out of the discussion packet.
The family’s decisions about downloads, content, purchases and downtime, with any school-managed device limits confirmed with the school.
A harmless walkthrough showing that an approval request, restricted setting and permitted activity work as intended.
What can this app collect, show or ask your child to share?
Look at the actual app together: its age rules, contacts, content, permissions and paid features. Include AI assistants, companion chatbots and connected toys. Discuss private information and how to check an answer with a trusted person; a friendly chatbot can give misleading or upsetting advice.
Things to review together
A short app list with its purpose, age eligibility and the adult who approves changes.
Decisions about camera, microphone, photos, location, conversation retention and any AI features.
A plan to pause an app, report upsetting content and ask a trusted adult for help, using a harmless example.
Who can contact your child or join their games and chats?
Review friend requests, direct messages, voice chat, public profiles and user-created rooms or content. Check both platform and game settings. Practice finding the report and block controls together, and agree what to do if someone asks to move a conversation to another app.
Things to review together
The games and chat services in use, including which accounts and consoles share settings.
Choices about public discovery, friends, voice, direct messages and streaming.
A walkthrough of reporting, blocking and leaving a conversation without engaging with an unknown person.
Is your family sharing only the information and location it intends to share?
Review profile visibility, photos, contact access and location sharing, including maps, games and connected devices. Decide who needs each feature and when. Talk about what a post may reveal about school, routines or the home before changing technical settings together.
Things to review together
The categories of information each app can access, without copies of private messages, photos or addresses.
Agreed audiences for posts and location sharing, and the adults authorized to make changes.
A check of the profile and sharing controls, including how to stop sharing or remove an account.
Could the family recover an important account or a lost device?
Give important accounts unique passwords and use a password manager, multifactor authentication or a passkey where appropriate and supported. Check recovery contacts and the adults responsible for family accounts. Keep recovery information in protected storage and make sure a device loss does not remove every recovery route.
Things to review together
An account-category list with owners and approved recovery methods; bring no passwords, codes or secret answers.
A check that account and device protections are enabled and that updates have an owner.
A harmless lost-device discussion and an approved recovery check that preserves access.
Can the family pause and check an unexpected request or purchase?
Talk through fake prizes, urgent messages, impersonation and requests for gift cards or account details. Verify a request through a known contact route. Review purchase approvals, saved payment methods, subscriptions and in-game currency so a click or trial does not become an unexpected bill.
Things to review together
The billing owner, approved stores and purchase-approval choices, with payment details kept private.
A way to review subscriptions, renewal notices and unexpected charges.
A harmless example of pausing a message, checking its sender and asking an adult before paying or sharing information.
Who keeps the router, cameras and other connected devices maintained?
Use supported router software, a unique administrator password and WPA3 or WPA2 protection where supported. Review guest access and which devices can reach each other. Include cameras, consoles, televisions and connected toys: check their updates, remote access and privacy settings as well as the Wi-Fi password.
Things to review together
A device-category list with owner, support status and update responsibility; leave network passwords out.
A router and guest-access review, with a practical isolation check where the equipment supports it.
Decisions about remote camera access, recordings, replacement of unsupported devices and a recoverable settings change.
Are the routines and help plan clear to children and caregivers?
Make a short plan together for apps, spending, schoolwork, bedtime and asking for help. Include adults’ habits and regular conversations about what is working. Coordinate authorized caregivers and the school for school-managed devices; check what each person can actually manage before promising a control.
Things to review together
The family’s agreed routines and the authorized adults who can update device or account settings.
A simple distinction between family-managed and school-managed devices and support contacts.
A check-in date and a way for a child to ask for help without fear that reporting a problem will automatically remove access.
Can your child reach a trusted adult and get help with unwanted contact or upsetting content?
Pause and tell a trusted adult. Use the platform’s report and block tools. For threats or suspected sexual exploitation, follow NCMEC’s guidance: keep the account and messages available rather than deleting them, and seek help through the CyberTipline. If someone is in immediate danger, call 911.
NCMEC’s Take It Down can help limit sharing on participating public or unencrypted platforms for explicit images taken when someone was under 18. Follow its instructions; do not download or forward an image to use the service. Use the help routes below for the situation you are facing.
Things to review together
A family help plan with a trusted adult, backup adult and another way to communicate if an account is unavailable.
The report and block steps for the apps in use, practiced with harmless material.
Known platform, NCMEC and local emergency help routes, without collecting children’s messages or images for a technical review.
Cybersecurity: Help authorized adults with scoped account recovery, supported reporting controls and a technical handover. Use the official support and emergency routes for urgent safeguarding needs.
Review prompt: Practice the help path before it is needed; check it after an incident or a change in apps and caregivers.
Who can approve the security priorities, resources and changes that engineering needs?
Name a program owner and connect contracts, engineering, IT, security, finance and leadership. Agree who can authorize access, accept a risk, approve a supplier and stop or release a delivery. A short recurring decision meeting helps turn open gaps into funded work with a completion check.
Evidence worth preparing
A decision and responsibility map, including deputies and escalation owners.
The business priorities, project dependencies and risks leadership needs to decide.
An agreed review calendar with actions, resources and completion evidence.
What information is each project permitted to handle, and which requirements apply?
Review the actual solicitation, contract and subcontract with the responsible contracts and security teams. Confirm FCI, CUI, applicable assessment requirements, required standards and the revision the contract calls for. Resolve uncertain information categories and flow-downs through the contracting officer or prime rather than assuming every project has the same scope.
Classified work needs its authorized industrial-security and information-system process. Involve the Facility Security Officer and information-system security team before planning that work or moving its information.
Evidence worth preparing
A protected requirement register linking each project to the relevant clauses, information categories and decision owner.
Confirmed handling routes and system boundaries, with unresolved classifications or requirements clearly marked.
The applicable assessment, reporting and subcontract requirements, checked against the contract and current official guidance.
Phantom Assurance: Build a requirement and responsibility register for the agreed scope and prepare a program roadmap with the customer’s contracts and security owners.
Review prompt: Recheck before a bid, new project, contract change or change to the information and systems involved.
Can you follow one engineering project from receipt through delivery and backup?
Trace email, collaboration, repositories, build logs, design files, firmware, test results, labs, supplier exchanges, customer delivery and backups. Include derived files and metadata that may carry project information. Identify the authorized systems and transfer routes, then check a representative workflow against the proposed boundary.
Evidence worth preparing
A sanitized data-flow map with information categories, systems, owners and processing locations.
An asset and service register covering engineering, support, external providers and backups.
Approved transfer paths and boundary decisions, with observed behavior and unknowns recorded separately.
Does access match each person’s role, project and approved period of work?
Include employees, contractors, support providers, administrators and build service accounts. Review multifactor authentication, privileged sessions and approved remote access. Track project transfers and departures through repositories, labs, cloud services and customer systems; confirm removal as well as approval.
Evidence worth preparing
A role and approval matrix with application and privileged-access owners.
MFA, service-account and recovery coverage, using redacted configuration evidence without tokens or recovery codes.
A completed access-change or removal record and an agreed exception review.
Cybersecurity: Review access in the authorized boundary, implement agreed identity and privilege improvements and check representative lifecycle outcomes.
Review prompt: Check at project and role changes, departures, new automation and recurring access reviews.
Can workstations and servers stay maintained without disrupting the approved engineering tools?
Connect inventory, patching, endpoint protection and configuration ownership to the tools people actually use. Include development laptops, build servers, remote work and specialist equipment. Test changes against engineering dependencies and give unsupported or constrained assets an owned treatment plan.
Evidence worth preparing
Asset owners, support status, baseline and update coverage across IT and engineering.
A compatibility check and recoverable change procedure for important toolchains.
Approved remote-support methods and an exception register with owner, treatment and review date.
Can you explain who changed, built, approved and released the delivered software?
Follow the code from repository permissions and review through build runners, dependencies and release approval. Limit automation privileges and protect signing keys and release artifacts. Record where dependencies came from, what was built and how a release can be checked or rolled back; plan how reported vulnerabilities reach an owner.
Evidence worth preparing
A sanitized pipeline map with repository rules, runner boundaries and release approvals.
Ownership and protected handling for build credentials and signing material, without exposing secret values.
A representative dependency and artifact record, release check and rollback or vulnerability-response procedure.
Do design files, firmware and test equipment follow the project’s information boundary?
Include CAD and schematics, manufacturing exchanges, firmware images, prototypes, programmers and test benches. Review removable media, remote maintenance and movement between lab and office systems. Plan approved updates, trusted image checks and recovery around the equipment’s support and operating constraints.
Evidence worth preparing
A lab and equipment inventory tied to project information categories and support owners.
Approved routes for design files, firmware, test output and supplier maintenance.
A representative image or configuration check and a controlled update or recovery rehearsal.
Cybersecurity: Review the agreed engineering and lab boundary, prioritize supported safeguards and verify representative transfers and maintenance paths.
Review prompt: Review before new equipment, a lab connection, a supplier visit or a design and firmware transfer change.
Can each provider handle the approved information, and are responsibilities clear?
Connect supplier access and data flows to the actual contract and service environment. Confirm subcontract requirements with the contracts team, and review cloud handling, incident cooperation, exports and exit arrangements. Record which safeguards a provider operates and which the customer must configure and maintain.
Evidence worth preparing
A provider register with service owner, information categories, locations and approved access.
A responsibility matrix and relevant contract or provider evidence for the specific environment.
Incident contacts, recovery and export arrangements, and a checked exit or access-removal plan.
Will a useful signal about access, code or a delivery reach someone who can act?
Review identity, endpoint, repository, build, cloud and relevant lab events. Agree time synchronization, protected log access and retention, then test that a useful event reaches the triage owner. Include sensitive information in logs and the limits of the agreed response coverage when planning collection.
Evidence worth preparing
A log-source and coverage register with owners, retention decisions and known blind spots.
A harmless test event with a receipt showing time, source and the response path.
Escalation responsibilities, coverage hours and the authorized access to collected evidence.
Who can decide containment, evidence preservation and the required notices?
Prepare the incident path with security, contracts, engineering, leadership and the relevant providers. Confirm applicable reporting triggers, time limits, channels and preservation duties from the contract and official requirements. Check access to the required reporting route before an incident, then rehearse decisions with a representative engineering scenario.
Route classified-information concerns through the Facility Security Officer and authorized information-system security team. Keep incident material in its approved protected environment.
Evidence worth preparing
A protected contact and decision matrix tied to the applicable reporting and preservation requirements.
Approved backup communications, reporting access and provider or prime coordination.
A tabletop record with decisions, open gaps, action owners and a follow-up date.
Could you restore a useful, trusted engineering or business service?
Identify the repositories, design and firmware records, build configuration and business services needed to resume work. Include the protected recovery of credentials and signing material through approved stores. Test a restoration in an authorized environment and check the result with the service owner, including dependencies and a trusted delivery path.
Evidence worth preparing
Owned recovery priorities, dependencies and acceptable service-loss decisions.
Backup coverage, retention and protected recovery arrangements without copies of project data or secret material.
A representative restore or rollback receipt with integrity, usability and owner acceptance checks.
Does each priority have an owner, an implementation step and a completion check?
Start with evidence from the agreed boundary, separate observed gaps from unknowns, and prioritize work by exposure and delivery impact. Give each improvement an owner, dependency and check. Maintain required system-security and remediation records where applicable, and prepare assessment evidence from actual operating work with a recurring review calendar.
Evidence worth preparing
A gap and action register with priority, owner, dependencies and acceptance evidence.
An implementation sequence that fits engineering change windows and available resources.
A protected evidence calendar linking requirements to owners, verified outcomes and review dates.
Phantom Assurance: Develop and implement a scoped security program, check improvements and prepare an evidence handover with optional agreed ongoing program support.
Review prompt: Check progress at implementation milestones and sustain a recurring program review as contracts and systems evolve.
These are preparation priorities, not a maturity score or a compliance determination. Scope, licensing, response coverage and recurring services are agreed separately.
Build your starting plan.
Your discussion starting point
Turn your priorities into a first conversation.
No priorities selected yet. Add a priority from the map to begin.
Layer8 Readiness Map · Edition 2.0 · October 6, 2026
Copy this link to reopen the same topics and audience. It contains topic choices only; add family or customer notes in your own protected workspace.
From a question to useful work.
1
Choose a question.
Choose the view and priorities that fit your work or family. Each view connects the question to practical preparation and a scoped next step.
2
Prepare useful evidence.
Prepare owners, categories and harmless examples. Keep family records, credentials, customer information, CUI and classified material in their approved protected environment.
3
Agree an owned next step.
Use the guides and offering links to discuss scope, deliverables, responsibilities and the check that will show completion.
The map stores no personal records and sends no inquiry. Your topic choices live in the page URL. A change between Home, Defense and organization views begins a plan for that audience; browser history can reopen the earlier choices. A printable starting plan helps prepare a conversation; it does not create a service agreement.
Give the next step an owner.
Use the selected priorities to prepare a family setup review, scoped assessment or operating review. We can agree the responsibilities, deliverables and completion checks for the first piece of work.