Cybersecurity Essentials Checklist

• MFA on every system, no exceptions
• Password manager required for all employees
• Admin accounts separated from daily accounts
• Offboarding revokes access within 24 hours
• Role-based permissions documented and reviewed quarterly
• 90% of breaches start with stolen credentials
• Harden identity and you close 90% of doors

• Full-disk encryption enabled
• Automated backups (3-2-1 rule: three copies, two media, one off-site)
• Sensitive data classified and access-restricted
• No customer data in shared drives accessible by everyone
• The SMBs who survive ransomware are the ones whose backups worked
• The ones who don't survive had backups that hadn't been tested

All company devices have endpoint protection.

• Written incident response plan: who calls whom, in what order, with what authority
• Phishing training quarterly — simulated, measured, celebrated for low click rates
• Security awareness as a standing item at all-hands
• Tabletop exercise annually
• Cyber insurance with a specialist broker
• Not if, when — and the companies with plans recover; the others survive, maybe