ProtectMyIT Risk Framework
The discipline behind the names
Commercial real estate has never tolerated vague risk. A property’s boundaries are surveyed, not estimated. Its encumbrances are recorded, not assumed. Its exposures are priced, not guessed at.
That precision exists because naming a risk precisely is the first step to finding it, pricing it, and fixing it – an unnamed risk is one nobody’s actually managing, no matter how many meetings get held about it.
Most cybersecurity and AI risk never gets that same treatment. It stays vague – “vendor access,” “shadow IT,” “AI risk” – described in terms too broad to actually locate the exposure inside a specific building or a specific workflow.
The ProtectMyIT Risk Framework is our answer to that gap: naming these risks with the same precision the CRE industry already demands everywhere else, so they can be found, assessed, and closed instead of just discussed.
The terms below are the vocabulary of that framework – some borrowed from real estate and related fields and applied to digital systems for the first time, some naming a category of exposure that never had a name at all.
*Unless otherwise noted, the terms below are commercial terms, not legal ones.
Property & Boundary Risk
Risk tied to a specific asset – the potential vulnerabilities in a property’s digital systems and the building systems inside it.
Cyber Encumbrance™
A weakness in a property’s digital or building systems – an unpatched server, a forgotten vendor login, an unsecured control system – that could affect a transaction. The word is borrowed from real estate as a commercial comparison only. It is not a legal encumbrance, and nothing is recorded against the title. The parallel is practical: before closing, a buyer wants to know what comes with the building, and these weaknesses come with it.
More context:
Cyber Encumbrance Assessment
Cyber Encumbrance Assessment™
A fixed-scope review of a property’s digital and building systems before a transaction – an acquisition, disposition, or refinance. It looks for cyber encumbrances so they can be fixed, disclosed, or priced in on your timeline. It plays a role similar to a Phase I environmental report: a pre-deal check of what comes with the property.
More context:
Your Buyer Could Find This. Would You Rather Find It First?
Cyber Encumbrance Assessment
Cyber Encumbrance Report™
The deliverable from a Cyber Encumbrance Assessment: a clear accounting of what’s connected to a property digitally, built to sit in the closing binder next to the title report and the environmental survey.
More context:
The Deal You’re About to Close Has a Digital Inspection Nobody Scheduled
Cyber Encumbrance Assessment
BMS Boundary Assessment™
ProtectMyIT’s BMS Boundary Assessment is the umbrella service that identifies and corrects unmanaged network placement for a building’s management systems (HVAC, elevators, access control, lighting automation). It answers where each system actually sits on the network, where it shouldn’t, and what to do about it — combining a Boundary Survey, an Encroachment Report, and ongoing Holdover Clearance.
More context:
BMS Boundary Assessment
BMS Boundary Survey™
ProtectMyIT’s BMS Boundary Survey consists of a full inventory of every building management system connected to a property’s network, documenting what each one is connected to, what it can reach, and whether it’s properly segmented from systems it has no reason to touch. The diagnostic first step of a BMS Boundary Assessment.
More context:
BMS Boundary Assessment
BMS Encroachment Report™
ProtectMyIT’s BMS Encroachment Report is a documented finding of any building management system installed across a network boundary it should never have crossed – such as an HVAC controller or access-control panel placed on the same network as financial or tenant systems by default, rather than by design.
More context:
BMS Boundary Assessment
Nobody Drew the Line
BMS Boundary Remediation™
The engineering phase that follows a BMS Encroachment Report: designing, piloting, and deploying the network segmentation, firewall policy, and controlled vendor remote access needed to correct the boundary a building management system should have had from the start. It’s the build step between diagnosis (the Encroachment Report) and ongoing upkeep (BMS Holdover Clearance).
More context:
BMS Boundary Assessment
BMS Holdover Clearance™
ProtectMyIT’s BMS Holdover Clearance is the recurring service that reviews and corrects building-system network access over time – closing out stale vendor credentials, re-segmenting systems as contracts and vendors change, and preventing a one-time encroachment finding from becoming a permanent, unexamined condition.
More context:
BMS Boundary Assessment
Nobody Drew the Line
AI & Data Risk
Risk tied to where confidential information actually goes once it leaves your systems.
BII = Business Identifiable Information
The term federal agencies (including the Department of Commerce and the U.S. Census Bureau) use for the category of confidential commercial and financial information protected under FOIA Exemption 4 (5 U.S.C. § 552(b)(4)) – trade secrets, financial data, and other business-sensitive information. The business equivalent of PII.
More context:
Your Data – and Others’ Too – Just Left the Building
BII Runoff™
The uncontrolled, ongoing leakage of Business Identifiable Information into AI tools outside an organization’s visibility or control – typically the result of employees uploading financial statements, insurance census data, A/P invoices, or other confidential business records into free or unapproved AI tools.
More context:
Your Data – and Others’ Too – Just Left the Building
BII Containment
Shadow AI vs Sanctioned AI
Shadow AI and Shadow IT
BII Containment™
The service that finds and closes BII Runoff: an initial audit of which AI tools are in use and what’s been shared with them, followed by approved-tool policy design, employee guidance, and ongoing monitoring to prevent new exposure.
More context:
BII Containment
Your Data – and Others’ Too – Just Left the Building
Incident Readiness & Recovery
Risk tied to how the business responds once something has already gone wrong.
CIRP = Comprehensive Incident Response Plan™
In addition to the coverage for cyber events as provided in the standard IRP (Incident Response Plan, explained elsewhere), the CIRP (Comprehensive Incident Response Plan) is a unique offering by IBS and additionally covers incident response planning for non-cyber disasters and disruptions.
With the CIRP, one policy/plan will cover most IT-related disruptions that could cause losses of revenue or unplanned expenses.
Incident Readiness & Recovery
Risk tied to the gap between what you attested and what’s actually true – the moment nobody checked, until someone else did.
Compliance Creep™
The gradual, usually unnoticed drift between what an organization attested to – on a cyber insurance application, a compliance certification, an audit response – and what’s actually true in the environment now. Nobody decides to fall out of compliance; a lapsed phishing test, an unenrolled new hire, or an unreviewed control just accumulates until the gap is real, whether or not anyone’s checked.
More context →
The Costs and Risks of Non-Compliance
