From Chaos to Clarity: Mastering Executive Digital Hygiene and Separating Personal from Corporate in 90 Days

Executive Digital Hygiene Security Assessment: Separating Personal from Corporate

The Complete Checklist for 2025

Scoring Methodology: Rate each item as Compliant (2 points), Partially Compliant (1 point), or Non-Compliant (0 points). Tally scores within each category and overall to determine your risk posture.

Stop leaving money on the table. AI automation that pays for itself.

Category 1: Device Separation and Management

Maximum Score: 16 points

| # | Check Item | 0 | 1 | 2 | |---|-----------|---|---|---| | 1.1 | Executive uses a dedicated corporate device for all business communications, separate from personal devices | ☐ | ☐ | ☐ | | 1.2 | Personal applications (social media, gaming, personal email) are absent from corporate devices | ☐ | ☐ | ☐ | | 1.3 | Corporate mobile device management (MDM) is enrolled and active on all business devices | ☐ | ☐ | ☐ | | 1.4 | Personal devices are prohibited from accessing corporate networks, email, or file repositories | ☐ | ☐ | ☐ | | 1.5 | Biometric authentication and strong PINs (6+ digits) are enabled on all devices | ☐ | ☐ | ☐ | | 1.6 | Automatic OS and application updates are enabled on both personal and corporate devices | ☐ | ☐ | ☐ | | 1.7 | Remote wipe capability is configured and tested on all corporate devices | ☐ | ☐ | ☐ | | 1.8 | USB and peripheral access policies are enforced, preventing unauthorized data transfer between personal and corporate environments | ☐ | ☐ | ☐ |

Category Score: / 16

Remediation Guidance: Non-compliant items in this category represent the highest-risk exposures. Prioritize issuing dedicated corporate devices and enrolling them in MDM within 30 days. Establish a clear acceptable-use policy that explicitly prohibits personal application installation on corporate hardware.

Category 2: Account and Identity Separation

Maximum Score: 14 points

| # | Check Item | 0 | 1 | 2 | |---|-----------|---|---|---| | 2.1 | Executive maintains entirely separate email addresses for personal and corporate use with no cross-forwarding | ☐ | ☐ | ☐ | | 2.2 | Corporate credentials are never reused for personal accounts (banking, social media, retail) | ☐ | ☐ | ☐ | | 2.3 | Hardware-based multi-factor authentication (FIDO2 keys) is deployed for all corporate accounts | ☐ | ☐ | ☐ | | 2.4 | Personal accounts also use MFA (authenticator app minimum; hardware key preferred) | ☐ | ☐ | ☐ | | 2.5 | A corporate password manager is used exclusively for business credentials, separate from any personal vault | ☐ | ☐ | ☐ | | 2.6 | Personal cloud storage accounts (Google Drive, iCloud, Dropbox personal) contain zero corporate data | ☐ | ☐ | ☐ | | 2.7 | Browser profiles are separated, with distinct profiles for corporate and personal browsing, each with appropriate extensions and sync settings | ☐ | ☐ | ☐ |

Category Score: / 14

Remediation Guidance: Conduct a credential audit using the corporate password manager's reporting features. Cross-reference personal breach databases (such as Have I Been Pwned) against any email addresses the executive uses. Migrate any corporate data found in personal cloud accounts immediately and document the transfer.

Category 3: Network and Communication Security

Maximum Score: 12 points

| # | Check Item | 0 | 1 | 2 | |---|-----------|---|---|---| | 3.1 | Executive uses a corporate VPN for all business-related internet activity when outside the office | ☐ | ☐ | ☐ | | 3.3 | Corporate communications occur exclusively through approved, encrypted platforms (not personal SMS or consumer messaging apps) | ☐ | ☐ | ☐ | | 3.4 | Public Wi-Fi is never used for corporate access without VPN protection | ☐ | ☐ | ☐ |

Category Score: / 12

Category 4: Social Media and Public Exposure

Maximum Score: 10 points

| # | Check Item | 0 | 1 | 2 | |---|-----------|---|---|---| | 4.1 | Personal social media accounts have maximum privacy settings enabled and do not reference corporate role, travel schedules, or internal projects | ☐ | ☐ | ☐ | | 4.3 | Executive has conducted a recent OSINT (open-source intelligence) self-assessment to identify publicly exposed personal data | ☐ | ☐ | ☐ | | 4.4 | Data broker opt-out requests have been submitted and verified across major aggregator sites | ☐ | ☐ | ☐ | | 4.5 | Family members' social media does not inadvertently expose executive location, routine, or corporate details | ☐ | ☐ | ☐ |

Category Score: / 10

Remediation Guidance: Engage a digital risk protection service to perform quarterly OSINT sweeps. Provide family members with a brief, respectful guide on social media practices that protect household security. Automate data broker removal through a dedicated service subscription.

Category 5: Incident Readiness and Awareness

Maximum Score: 8 points

| # | Check Item | 0 | 1 | 2 | |---|-----------|---|---|---| | 5.1 | Executive has completed targeted anti-phishing and social engineering training within the past 90 days | ☐ | ☐ | ☐ | | 5.2 | A documented personal-device compromise response plan exists and the executive knows how to activate it | ☐ | ☐ | ☐ | | 5.4 | Simulated spear-phishing exercises targeting the executive are conducted at least quarterly, with results tracked | ☐ | ☐ | ☐ |

Category Score: / 8

Remediation Guidance: Schedule a private, one-on-one training session rather than generic group training. Executives are high-value targets for whale phishing; simulations should reflect realistic scenarios such as fake board communications, fraudulent M&A documents, or impersonated legal counsel.

Overall Scoring and Risk Rating

| Total Score | Risk Rating | Action Required | |------------|-------------|-----------------| | 52–60 | Low Risk | Maintain current posture. Reassess in 90 days. | | 40–51 | Moderate Risk | Address non-compliant items within 30 days. Schedule follow-up assessment. | | 0–24 | Critical Risk | Escalate to CISO. Assume potential compromise and conduct forensic review before remediation. |

Your Total Score: / 60 — Risk Rating: ___________

Next Steps

1. Document all non-compliant and partially compliant findings.
2. Prioritize remediation by category weight: Device Separation first, then Account Separation.
3. Assign ownership for each remediation item with a specific deadline.
4. Reassess within 30 days for high-risk findings, 90 days for moderate.
5. Archive completed checklists to track improvement over time and demonstrate due diligence.