Backups are the one control that matters after everything else has failed. The question is not whether a backup job runs, but whether you could recover from it under pressure.
Know what is covered — servers, cloud data, email and staff laptops.
Keep one copy offline or immutable so ransomware cannot reach it.
Test a real restore every quarter and record the result.
Write down the recovery time you would need, then check whether you would meet it.
02
Multi-factor authentication on the accounts that matter
Most account takeovers start with a password. MFA is inexpensive, widely available and stops a large share of attacks before they begin.
Enable MFA on email, remote access and accounting systems first.
Protect admin accounts, even if only a few people use them.
Prefer authenticator apps or security keys over SMS where possible.
Remove MFA and access immediately when someone leaves.
03
Patching with a routine, not good intentions
Known vulnerabilities with available fixes are among the easiest routes in. A routine matters more than a perfect tool.
Patch operating systems, browsers and common applications automatically where possible.
Schedule server patching with a rollback plan and a maintenance window.
Include firewalls, switches and access points — not just computers.
Replace software that no longer receives security updates.
04
Endpoint protection on every device
Every laptop and desktop should be covered, updating and visible. The most common failure is a subscription that lapsed unnoticed.
Confirm coverage on every device, including management and finance machines.
Check that alerts reach a person who will act on them.
Enable disk encryption on laptops that leave the office.
Have a way to remotely lock or wipe a lost device.
05
A network that is separated and supported
Guest Wi-Fi on the same network as your file server is a small decision with large consequences. The basics are straightforward.
Separate guest, staff and device traffic.
Keep firewall firmware current and review its rules periodically.
Change Wi-Fi credentials after staff or contractors leave.
Document the ports, devices and configurations so support is not guesswork.
06
Devices and licensing you can account for
You cannot plan around hardware you have not inventoried, or prove compliance for licences you cannot find.
Keep an asset list with purchase date, user, warranty and serial number.
Note devices nearing end of life and plan replacements before failure.
Store licence proof in one place with renewal dates.
Cancel unused subscriptions and right-size renewals.
07
Documentation and a one-page incident plan
If the person who knows the IT is unavailable, the business should still be able to function. Documentation is what makes that possible.
List critical systems, vendors, account owners and support contacts.
Store admin credentials in a secure password manager, not a spreadsheet.
Write a one-page plan: who to call, how to isolate systems, who communicates.
Review it once a year, or whenever a key person changes.
Prioritise like this: anything that can cause data loss or a security breach is urgent. Anything that creates recurring friction is important. Tidy-ups and documentation are housekeeping — valuable, but never allowed to block the first two.
