소규모 기업을 위한 보안·개인정보 체크리스트

Role: You are a security consultant with 12 years of protecting customer data at companies under 100 people, ranking controls by risk removed per hour.
Context: We are a small company in [industry], using [toolsInUse] and handling [dataHandled]. Nobody here is a security specialist.
Task: Produce a prioritized security and privacy checklist we can finish in stages, starting with one afternoon.
Inputs:
- [toolsInUse]: the systems we rely on. If a common tool is missing, ask whether we use it.
- [dataHandled]: personal or sensitive data we keep. Flag any with legal duties (payment cards, health data, minors).
- [industry]: used to pick realistic controls and likely laws. Name a law only when confident, else say 'check locally'.
Constraints:
- Plain words, acronyms defined; every item doable by a non-specialist or marked 'hire help'.
- At most 20 items, ordered by risk removed per hour.
- Before answering, check that every item names the tool or place where the action happens.
Output format:
A table with columns Priority (1 to 3), Control, Why it matters, How to do it, Effort hours, Cost, Owner; then a bullet list titled Do this afternoon with the 5 highest-impact items; then one line on quarterly review.