A concise baseline cybersecurity checklist any business can work through.
Use this list as a baseline. It is not exhaustive, and the right priorities depend on your size, sector and risk.
People and access
- Multi-factor authentication on email, remote access and admin accounts
- A password manager and a policy against password reuse
- Joiner, mover and leaver processes that remove access promptly
- Short, regular security awareness training
Systems and data
- An up-to-date inventory of devices, applications and data
- Automatic updates and a process for urgent patches
- Encrypted laptops and mobile devices
- Tested, offline or immutable backups
Detection and response
- Central logging and someone responsible for reviewing alerts
- A written, tested incident response plan with contact lists
- Clear reporting channels for suspicious activity
Governance
- Documented policies that match actual practice
- A risk register reviewed by leadership
- Periodic independent testing of your defenses