What would happen to your business tomorrow if you got hacked today?
Not "could it happen?" — that question is already answered. The real question is: are you ready?
In Episode 86 of UnHacked, hosts Justin Shelley (Phoenix IT Advisors), Mario Zaki (Mazteck IT), and Bryan Lachapelle (B4 Networks) tackle one of the most overlooked and underestimated layers of business cybersecurity: policies, procedures, and incident response planning. This is Episode 12 in their ongoing Cybersecurity Basics mini-series — and it might be the most actionable one yet.
Why This Episode Matters to You as a Business Owner
Ask yourself: if someone asked your employees right now what your company's cybersecurity policy is, what would they say? If the answer is "I don't know" or "I think the IT guys handle that" — you are exposed. Not theoretically. Practically. Right now.
Policies and procedures aren't just bureaucratic paperwork. They are the human firewall that fills the gaps where technology cannot. As Bryan Lachapelle puts it in this episode: "All the tools we put in place — those don't stop breaches. Behavior does."
That single sentence is worth the entire listen.
What You'll Learn in This Episode
🔒 The Top 3 Policies Your Business Needs Right Now
The hosts each weigh in on their single most important policy. Bryan's top pick — an AI Policy — may surprise you. With employees increasingly turning to free public AI tools, sensitive business data, client information, and internal communications are being fed into systems your company has zero control over. An AI policy defines what tools employees can use, under what conditions, and what is absolutely off-limits. It's not optional anymore.
The other critical policies discussed: an Acceptable Use Policy and a Technology Management Policy — the internal commitments your IT department or provider makes to keep your business safe.
📋 The Three Elements Every Policy Must Have (Most Have None)
A policy buried in a 300-page employee handbook that nobody reads isn't a policy — it's a liability. Bryan identifies three non-negotiable components every policy must include:
- Clarity — written in plain language any employee can understand and explain
- An Owner — one person responsible for championing and enforcing it
- A Review Date — because a policy written before AI existed is already out of date
🚨 Why Your Incident Response Plan Is Not Just an IT Problem
Most business owners hand off cybersecurity entirely to their IT team and assume an incident response plan is a technical document. It isn't. As Justin explains, an incident response plan should answer: "How do we run this business until we're back to full operation?" Who communicates with customers? Who manages finance decisions? Who is the incident commander? These are business decisions — not IT decisions — and they need to be made before the fire alarm goes off.
Mario illustrates it perfectly with an analogy every business owner will recognize: imagine reaching into your back pocket and your wallet is gone. The panic, the mental scramble to remember every card, every number to call — now multiply that by your entire company, your customer data, and your operational infrastructure. The business owners who survive that moment are the ones who built the list before the wallet went missing.
🧠 Building a Real Culture Around Security — Not Just Compliance
Justin shares a method he's used successfully in his own company: making security values a living, recurring conversation — not a one-time sign-off at onboarding. Weekly team meetings, positive call-outs, real-world examples of the policy in action — these are the mechanisms that transform a signed document into a genuine operating culture. The goal isn't to catch people doing something wrong. It's to create an environment where doing the right thing becomes the norm.
📊 The POEM — Your Most Important Cybersecurity Document
Justin's personal top pick for the single most important policy-adjacent document a business owner can have? A Plan of Action and Milestones (POEM). With dozens of potential security controls, frameworks, and recommendations in play, no business can do everything at once. The POEM gives you a realistic, scored snapshot of where you stand, what you're missing, and a step-by-step roadmap to close the gaps — without the paralysis of feeling like you have to fix everything overnight. One percent better every day. One hundred days to transformation.
🚀 Big Announcement: The UnHacked Free Portal
For the first time, the UnHacked team is building a free, publicly accessible portal where business owners can:
- Score their current cybersecurity posture
- Generate a personalized Plan of Action and Milestones
- Access how-to resources, checklists, and guidance
- Hold their IT department or MSP accountable with real metrics
This isn't a sales funnel. It's a genuine commitment to giving business owners — regardless of their budget or who they hire — the tools to understand and manage their own digital risk. No cost. No spam. Just clarity.
The Bottom Line
If you've been telling yourself "my IT company handles that" without being able to tell someone what exactly they handle, what your current security score is, or what your company's plan is for Day 1 of a breach — this episode is a mirror. It's not comfortable. But neither is a ransomware attack at 9 AM on a Tuesday.
The three hosts of UnHacked have collectively decades of experience helping businesses just like yours survive — and more importantly, prevent — the worst-case scenario. This episode is 35 minutes of hard-earned, real-world knowledge delivered in plain language, with a healthy dose of humor and zero corporate jargon.
Listen. Then act.
🎯 Ready to Find Out How Secure Your Business Actually Is?
Stop guessing. Stop hoping. Start knowing.
Book your free cybersecurity risk assessment with Phoenix IT Advisors today.
Visit phoenixitadvisors.com and mention UnHacked — we'll show you exactly where you stand and what it takes to protect everything you've built.
UnHacked is hosted by Justin Shelley of Phoenix IT Advisors, Mario Zaki of Mazteck IT, and Bryan Lachapelle of B4 Networks. New episodes drop weekly.
Schedule Your Free Security Assessment - and mention UnHacked.