1. Purpose

This guide defines a minimal but effective IT management process for a startup company developing AI solutions. The goal is to establish practical IT operations, security, and compliance processes that support SOC 2 and ISO 27001 readiness without creating unnecessary enterprise overhead.

This guide covers:

• Microsoft 365 or Google Workspace
• Identity and Access Management
• Employee onboarding and offboarding
• Endpoint protection and response
• IT asset lifecycle management
• VPN or Zero Trust Network Access
• Ticketing and documentation
• Source code version management
• Device management using Intune or Jamf
• Compliance automation using platforms such as Vanta
• Additional AI-specific governance processes

2. Guiding Principles

The IT management program should follow these principles:

1. Centralize identity
   Use Microsoft Entra ID or Google Workspace as the source of truth for user identities.
2. Automate where possible
   Use MDM, XDR, SSO, MFA, and Vanta integrations to reduce manual evidence collection.
3. Use tickets for traceability
   Access requests, changes, incidents, asset requests, and exceptions should be tracked in a ticketing system.
4. Apply least privilege
   Users should receive only the access needed for their role.
5. Secure every endpoint
   Company devices must be encrypted, managed, patched, and protected by XDR or EDR.
6. Require review and approval
   Production changes, privileged access, and exceptions must be reviewed and approved.
7. Keep documentation lightweight but complete
   Policies and procedures should be practical, current, version-controlled, and reviewed at least annually.
8. Protect customer and AI data
   Customer data, training data, prompts, and model outputs must be classified, protected, and used only for approved purposes.

3. Recommended Operating Model

Use one primary system of record for each major IT and compliance area.

4. Core IT Management Processes

The following processes form the minimal ITSM foundation.

4.1 Service Request Management

Purpose

Centralize and track IT requests, access requests, asset requests, software requests, and operational support needs.

Scope

This process applies to:

• New user setup
• Access requests
• Device requests
• Software requests
• SaaS access
• VPN or ZTNA access
• Security exceptions
• IT support requests

Minimum Workflow

1. User or manager submits a ticket.
2. Request is categorized.
3. Required approval is obtained.
4. IT or system owner fulfills the request.
5. Evidence is attached or linked.
6. Ticket is closed.

Required Evidence

• Ticket ID
• Requester
• Approver
• Business justification
• Fulfillment date
• Assigned access or asset
• Closure notes

4.2 Employee Onboarding

Purpose

Ensure new employees, contractors, and interns receive the correct access, devices, and security training before starting work.

Trigger

The process starts when HR or the hiring manager submits an onboarding request.

Minimum Workflow

1. HR or manager creates an onboarding ticket.
2. IT creates the user account in Microsoft 365, Google Workspace, or the identity provider.
3. User is assigned to role-based groups.
4. Device is assigned and enrolled in MDM.
5. XDR / EDR is installed and verified.
6. Required SaaS access is granted.
7. GitHub / GitLab access is granted if needed.
8. Jira / Confluence access is granted if needed.
9. VPN or ZTNA access is granted if needed.
10. Security training and policy acknowledgment are completed.
11. Manager confirms access is appropriate.
12. Ticket is closed with evidence.

Required Evidence

• Onboarding ticket
• Manager approval
• User account creation timestamp
• Group membership
• Device assignment
• MDM enrollment status
• XDR / EDR status
• Security training completion
• Policy acknowledgment

Standard SLA

4.3 Employee Offboarding

Purpose

Ensure access is removed promptly when an employee, contractor, or intern leaves the company.

Trigger

The process starts when HR or the manager submits an offboarding request.

Minimum Workflow

1. HR or manager creates an offboarding ticket.
2. IT disables the user account on the termination date.
3. Active sessions are revoked.
4. Password is reset or account is suspended.
5. User is removed from all role-based groups.
6. SaaS access is removed.
7. GitHub / GitLab access is removed.
8. Cloud access is removed.
9. VPN or ZTNA access is removed.
10. Jira / Confluence ownership is transferred if needed.
11. Email and file ownership are transferred if needed.
12. Company device is recovered, locked, or wiped.
13. Asset inventory is updated.
14. Ticket is closed with evidence.

Required Evidence

• Offboarding ticket
• HR or manager request
• Account disablement timestamp
• Access removal confirmation
• Group removal evidence
• Source code access removal evidence
• VPN / ZTNA removal evidence
• Device recovery or wipe evidence
• Final closure confirmation

Standard SLA

4.4 Identity and Access Management

Purpose

Ensure access to systems, applications, source code, cloud environments, and data is approved, appropriate, and periodically reviewed.

Scope

This process applies to:

• Microsoft 365
• Google Workspace
• GitHub / GitLab
• Jira / Confluence
• Cloud platforms
• VPN / ZTNA
• Production systems
• Customer data systems
• AI data systems
• Administrative accounts

Minimum Workflow

1. User submits access request.
2. Manager or system owner reviews request.
3. Access is approved or rejected.
4. IT or system owner grants access.
5. Access is granted using groups where possible.
6. Ticket is closed with evidence.
7. Access is reviewed periodically.

Required Approval

Access Review Cadence

Required Evidence

• Access request ticket
• Business justification
• Approval
• Access grant confirmation
• Group membership
• Periodic access review record
• Removal evidence when no longer needed

4.5 Endpoint Protection and Response

Purpose

Protect company endpoints from malware, data loss, unauthorized access, and compromise.

Scope

This process applies to:

• Company laptops
• Contractor devices, where allowed
• Mobile devices accessing company data
• Developer workstations
• Privileged-user devices

Minimum Requirements

Minimum Workflow

1. Device is purchased or assigned.
2. Device is recorded in asset inventory.
3. Device is enrolled in Intune, Jamf, or approved MDM.
4. Security baseline is applied.
5. XDR / EDR is installed.
6. Encryption is verified.
7. Compliance status is monitored.
8. Non-compliant devices are remediated or blocked.
9. Lost or stolen devices are locked or wiped.
10. Retired devices are wiped and disposed of securely.

Required Evidence

• Asset record
• MDM enrollment status
• Encryption status
• XDR / EDR status
• Patch compliance
• Security baseline status
• Lost device ticket, if applicable
• Device wipe or disposal record

4.6 IT Asset Lifecycle Management

Purpose

Maintain accurate records of company IT assets from purchase through retirement.

Asset Types

Required Asset Fields

Lifecycle

1. Request
2. Approval
3. Purchase or provisioning
4. Assignment
5. Secure configuration
6. Monitoring
7. Review
8. Recovery
9. Wipe or deprovisioning
10. Disposal

Required Evidence

• Asset inventory
• Purchase approval
• Assignment record
• Security status
• Review record
• Disposal or deprovisioning evidence

4.7 VPN and Zero Trust Network Access

Purpose

Control remote access to office networks, cloud environments, internal tools, and production systems.

Preferred Approach

Use Zero Trust Network Access where possible. Traditional VPN is acceptable if protected by MFA, device compliance, access groups, and logging.

Minimum Requirements

Minimum Workflow

1. User submits VPN or ZTNA access request.
2. Manager approves business need.
3. IT verifies device compliance.
4. Access is granted through a group.
5. User authenticates using MFA.
6. Logs are retained.
7. Access is reviewed quarterly.
8. Access is removed during offboarding.

Required Evidence

• Access request ticket
• Approval
• User group membership
• MFA status
• Device compliance status
• Access logs
• Quarterly review record

4.8 Ticketing and Document Management

Purpose

Ensure IT work, security work, compliance actions, and operational decisions are traceable.

Ticketing System

The company should use Jira, Jira Service Management, Linear, GitHub Issues, or another approved ticketing system.

Minimum Ticket Types

Documentation System

The company should use Confluence, SharePoint, Google Drive, Notion, or a Git repository for official documents.

Minimum Document Controls

Each official document must include:

• Title
• Owner
• Version
• Approval date
• Last review date
• Next review date
• Change history
• Approval evidence

Required Evidence

• Tickets
• Approvals
• Linked documents
• Version history
• Review records
• Closure notes

4.9 Source Code Version Management

Purpose

Protect source code and ensure software changes are reviewed, tested, approved, and traceable.

Scope

This process applies to:

• GitHub
• GitLab
• Application repositories
• Infrastructure-as-code repositories
• AI model code
• Prompt templates
• Deployment scripts
• CI/CD pipelines

Minimum Controls

Minimum Workflow

1. Developer creates issue, ticket, or change request.
2. Developer creates branch.
3. Developer opens pull request or merge request.
4. Automated tests and security scans run.
5. Reviewer approves.
6. Code is merged into protected branch.
7. Deployment is executed through approved pipeline.
8. Ticket is updated and closed.

Required Evidence

• Issue or ticket
• Pull request or merge request
• Reviewer approval
• CI/CD results
• Security scan result
• Deployment log
• Branch protection settings

4.10 Automatic Device Management

Purpose

Ensure endpoints are securely configured, monitored, and compliant before accessing company systems.

Recommended Tools

Minimum Device Compliance Policy

Devices must meet the following requirements:

1. Enrolled in MDM.
2. Assigned to a known user.
3. Disk encryption enabled.
4. Firewall enabled.
5. Screen lock enabled.
6. Supported operating system version.
7. Critical patches installed.
8. XDR / EDR installed and healthy.
9. No jailbreak or root.
10. Local administrator rights restricted.
11. Lost devices can be locked or wiped.

Required Evidence

• MDM inventory
• Compliance policy
• Device compliance report
• Encryption status
• Patch status
• XDR / EDR health
• Exception tickets

4.11 Compliance Automation with Vanta

Purpose

Use Vanta or a similar platform to automate evidence collection, monitor control status, and support SOC 2 and ISO 27001 readiness.

Recommended Integrations

Minimum Workflow

1. Connect core systems to Vanta.
2. Map controls to SOC 2 and ISO 27001 requirements.
3. Review failed checks weekly during readiness.
4. Create remediation tickets for failed checks.
5. Attach or sync evidence.
6. Review control health monthly after certification.
7. Export evidence for auditors when needed.

Required Evidence

• Vanta integration status
• Control status
• Failed control remediation tickets
• Policy evidence
• Access review evidence
• Device compliance evidence
• Vulnerability remediation evidence

5. Additional Essential Processes for AI Startups

5.1 AI Data Governance

Purpose

Ensure customer data, training data, prompt data, and model outputs are used responsibly and in accordance with company policy, customer agreements, and applicable laws.

Minimum Requirements

Required Evidence

• Data inventory
• Data classification
• Customer data use approval
• Approved AI tool list
• Training dataset record
• Retention policy
• Deletion request record

5.2 Secure AI Development

Purpose

Ensure AI features are designed, developed, tested, and deployed securely.

Minimum Controls

1. Threat modeling for AI features.
2. Prompt injection testing.
3. Data leakage testing.
4. Model access control.
5. Abuse monitoring.
6. Human review for high-risk outputs.
7. Logging of model access and administrative actions.
8. Evaluation records for major model or prompt changes.
9. Approval for production model changes.
10. Documentation of limitations and risks.

Required Evidence

• AI feature design review
• Threat model
• Test results
• Model evaluation records
• Prompt change history
• Approval record
• Deployment record

5.3 Vendor and SaaS Risk Management

Purpose

Ensure third-party tools and vendors are reviewed before they are used to process company, customer, or AI data.

Minimum Workflow

1. Business owner submits vendor review ticket.
2. Data shared with vendor is identified.
3. Vendor security posture is reviewed.
4. SOC 2, ISO 27001, or equivalent security documentation is requested where appropriate.
5. DPA, privacy policy, sub-processors, and retention terms are reviewed.
6. SSO and MFA support are confirmed.
7. Vendor is approved or rejected.
8. Vendor is added to inventory.
9. Vendor is reviewed annually.

Required Evidence

• Vendor review ticket
• Business owner
• Data classification
• Security documentation
• DPA or contract review
• Approval
• Annual review record

5.4 Backup and Recovery

Purpose

Ensure critical systems and data can be recovered after accidental deletion, outage, ransomware, or security incident.

Minimum Requirements

Required Evidence

• Backup configuration
• Critical system inventory
• Restore test result
• RTO / RPO definition
• Backup access review
• Incident recovery record, if applicable

5.5 Security Awareness and Training

Purpose

Ensure employees understand their security responsibilities.

Minimum Requirements

Required Evidence

• Training assignment
• Completion record
• Policy acknowledgment
• Training content
• Exception record

6. Minimum Policy Set

The company should maintain the following policies and procedures.

7. Minimum Review Cadence

8. SOC 2 and ISO 27001 Alignment

9. Implementation Roadmap

Phase 1: First 30 Days

Objectives

Establish the minimum security and IT management foundation.

Key Activities

1. Select Microsoft 365 or Google Workspace as the identity anchor.
2. Enforce MFA for all users.
3. Create onboarding and offboarding checklists.
4. Create ticket types for:
   • Access requests
   • Onboarding
   • Offboarding
   • Change requests
   • Incidents
   • Asset requests
   • Vendor reviews
   • Exceptions
5. Enroll all laptops in Intune or Jamf.
6. Deploy XDR / EDR to all company endpoints.
7. Enable GitHub or GitLab MFA and SSO.
8. Enable branch protection for production repositories.
9. Require pull request or merge request reviews.
10. Create basic IT asset inventory.
11. Connect Vanta to:
    • Identity provider
    • MDM
    • GitHub / GitLab
    • Cloud provider
    • Ticketing system

Phase 2: Days 31–60

Objectives

Formalize core policies and strengthen operational controls.

Key Activities

1. Publish core IT and security policies.
2. Define access review process.
3. Define patch and vulnerability SLAs.
4. Implement VPN or ZTNA access controls.
5. Create production change workflow.
6. Create vendor review workflow.
7. Create incident response workflow.
8. Create AI data handling policy.
9. Create secure AI development checklist.
10. Begin tracking control gaps in Vanta.

Phase 3: Days 61–90

Objectives

Validate the program and prepare for audit readiness.

Key Activities

1. Run the first access review.
2. Run the first privileged access review.
3. Run the first device compliance review.
4. Run the first vendor review.
5. Run the first vulnerability review.
6. Conduct an incident response tabletop exercise.
7. Perform a backup restore test.
8. Review all Vanta control failures.
9. Create remediation tickets.
10. Prepare SOC 2 and ISO 27001 evidence package.

10. Minimum Ticket Templates

10.1 Access Request Ticket

## Access Request

**Requester:**  
**User needing access:**  
**System or application:**  
**Access level requested:**  
**Business justification:**  
**Data classification involved:**  
**Temporary or permanent access:**  
**Expiration date, if temporary:**  
**Manager approval:**  
**System owner approval:**  
**Date access granted:**  
**Implemented by:**  
**Evidence attached:**  

10.2 Onboarding Ticket

## Employee Onboarding

**Employee name:**  
**Role:**  
**Department:**  
**Manager:**  
**Start date:**  
**Employment type:** Full-time / Contractor / Intern  
**Location:**  
**Device required:** Yes / No  
**Required applications:**  
**Required groups:**  
**GitHub / GitLab access:** Yes / No  
**Cloud access:** Yes / No  
**VPN / ZTNA access:** Yes / No  
**Security training completed:** Yes / No  
**Policy acknowledgment completed:** Yes / No  
**Manager confirmation:**  
**IT completion date:**  

10.3 Offboarding Ticket

## Employee Offboarding

**Employee name:**  
**Manager:**  
**Termination date:**  
**Termination type:** Voluntary / Involuntary / Contractor end  
**Disable identity account:** Complete / Pending  
**Revoke active sessions:** Complete / Pending  
**Remove SaaS access:** Complete / Pending  
**Remove GitHub / GitLab access:** Complete / Pending  
**Remove cloud access:** Complete / Pending  
**Remove VPN / ZTNA access:** Complete / Pending  
**Transfer file ownership:** Complete / Not applicable  
**Transfer ticket ownership:** Complete / Not applicable  
**Recover device:** Complete / Pending / Not applicable  
**Wipe device:** Complete / Pending / Not applicable  
**Final review by IT:**  
**Closure date:**  

10.4 Change Request Ticket

## Change Request

**Change title:**  
**Requester:**  
**System affected:**  
**Environment:** Production / Staging / Development  
**Change type:** Standard / Normal / Emergency  
**Business reason:**  
**Risk level:** Low / Medium / High  
**Implementation plan:**  
**Rollback plan:**  
**Testing completed:** Yes / No  
**Approver:**  
**Scheduled date:**  
**Implementation result:**  
**Post-change validation:**  
**Linked pull request / merge request:**  
**Deployment evidence:**  

10.5 Incident Ticket

## Incident Record

**Incident title:**  
**Reported by:**  
**Date and time detected:**  
**Severity:** Low / Medium / High / Critical  
**Systems affected:**  
**Data affected:**  
**Customer impact:** Yes / No / Unknown  
**Initial description:**  
**Containment actions:**  
**Root cause:**  
**Corrective actions:**  
**Owner:**  
**Resolution date:**  
**Post-incident review completed:** Yes / No  
**Lessons learned:**  
**Follow-up tickets:**  

10.6 Vendor Review Ticket

## Vendor Review

**Vendor name:**  
**Business owner:**  
**Purpose:**  
**Data shared with vendor:**  
**Data classification:**  
**Customer data involved:** Yes / No  
**PII involved:** Yes / No  
**AI training or model use involved:** Yes / No  
**SSO supported:** Yes / No  
**MFA supported:** Yes / No  
**SOC 2 / ISO 27001 report available:** Yes / No  
**DPA required:** Yes / No  
**Privacy policy reviewed:** Yes / No  
**Sub-processors reviewed:** Yes / No  
**Approved by:**  
**Approval date:**  
**Next review date:**  

11. Exception Management

Purpose

Allow temporary exceptions when business needs require deviation from policy while ensuring risk is documented, approved, and time-bound.

Minimum Workflow

1. User submits exception request.
2. Risk is documented.
3. Compensating controls are identified.
4. Security or IT owner approves.
5. Expiration date is assigned.
6. Exception is reviewed before expiration.
7. Exception is closed or renewed.

Required Evidence

• Exception ticket
• Business justification
• Risk description
• Compensating controls
• Approval
• Expiration date
• Review outcome

12. Metrics and Reporting

The company should track a small set of operational and compliance metrics.

13. Roles and Responsibilities

14. Practical Minimum Control Statement

The startup should operate according to the following rule:

No access without approval.
No device without management.
No code change without review.
No production change without traceability.
No vendor without ownership.
No customer data use without documented permission.
No compliance evidence without automation where practical.

15. Summary

This IT Management Guide provides a lean operating model suitable for an AI startup preparing for SOC 2 and ISO 27001.

The minimum program should include:

• Centralized identity
• MFA for all users
• Structured onboarding and offboarding
• Ticket-based access requests
• Managed and protected endpoints
• Asset lifecycle tracking
• VPN or ZTNA access control
• Secure source code management
• Change management
• Incident response
• Vulnerability management
• Vendor review
• AI data governance
• Compliance automation using Vanta or equivalent

The goal is not to create heavy process overhead. The goal is to create a repeatable, auditable, and secure way to operate the company as it grows.