Key takeaways
- •Secure important online accounts with strong authentication and sensible recovery options.
- •Keep devices and software supported and protected.
- •Maintain backups and test restoration.
- •Give staff a clear route to report suspicious activity.
- •Prioritise actions by business impact and available resource.
Start with the accounts that matter most
List email, administrator, finance and cloud accounts that can reach sensitive information or change important systems. Review who can access them, use multi-factor authentication where available and remove access that is no longer needed.
Protect devices and keep them maintained
Know which laptops, desktops, servers and mobile devices are used for work. Use supported operating systems, protection software and a process for applying important updates. Lost or unmanaged equipment should have a clear reporting path.
Layer email and people controls
Filtering can reduce unwanted and malicious email, but it cannot catch every convincing message. Combine mail protections with multi-factor authentication, verification for payment or bank-detail changes and practical user reporting.
Plan for recovery before an incident
Identify data and services that the organisation would need to restore first. Keep backup access appropriately separate from day-to-day accounts, define responsibilities and test that restoration works. A backup that has never been restored is an untested assumption.
Review, assign and improve
Turn findings into a short prioritised action list with an owner and a sensible review date. Revisit it after major changes such as new cloud services, acquisitions, remote-working changes or a security incident.
- What is the impact if this system or data becomes unavailable?
- Who owns the control and who approves exceptions?
- What can be fixed quickly without disrupting service?
Sources and further guidance
Official guidance may change. Check the source directly for current requirements. This article is general information, not legal advice.
Put your next step into context.
A free 30-minute cybersecurity review provides a Red, Amber or Green score and prioritised fixes.
Book a review