Tools built to be used, not admired.

Turn on multi-factor authentication

Enable MFA for email, administrator, remote-access and other high-value accounts. Prefer stronger methods where the service supports them.

Use unique passwords and passphrases

Use a password manager to create unique credentials. Protect the manager with MFA and a long, unique passphrase.

Keep software supported and updated

Turn on automatic updates where appropriate and maintain an inventory of operating systems, applications, network devices and plugins.

Limit access and administrator rights

Give people only the access they need. Use separate administrator accounts, review access regularly and remove access when roles change.

Control applications and risky content

Use application control where practical, restrict internet-sourced Office macros and harden browsers, PDF readers and Office applications.

Protect email and domains

Use provider security controls, protect domain administration with MFA and give staff a clear way to report suspicious messages.

Back up important information

Define what is backed up, where it is stored, who owns it and how often restores are tested. Keep a protected or offline copy where appropriate.

Monitor important activity

Keep useful security logs and alerts for identity, endpoint, email and backup systems. Decide who reviews alerts and when.

Prepare an incident response plan

Keep current contacts, containment steps, decision rights and reporting pathways. Practise the plan so the first response is deliberate.

Review progress

Set a review date, record exceptions and prioritise the controls that protect your most important accounts, information and services.