Security you can put into practice.

Accounts, MFA and passkeys

A stolen login can expose email, money and the accounts that recover everything else.

Basic

Inventory important accounts; use unique passwords, a password manager and MFA wherever offered. Protect recovery email and store recovery codes privately.

Strong

Prefer phishing-resistant passkeys or security keys, beginning with email, banking and administrators. Separate everyday and admin accounts; remove former users.

Best

Review access and recovery paths on a written schedule; test an authorized recovery with a spare method and monitor unexpected sign-ins. Record and time offboarding.

Tools and resources: Built-in account security dashboards; platform passkey support; Apple Passwords or KeePassXC (https://keepassxc.org/). Hardware keys may cost money.

Evidence: A redacted settings view showing enrollment and account coverage; never record passwords, seeds or recovery codes.

Source principle: CISA Secure Our World MFA guidance — https://www.cisa.gov/secure-our-world/turn-mfa

Email authentication: SPF, DKIM and DMARC

These are email settings that help stop others from sending mail pretending to be you.

Mail that looks like your organization can be used to request money or steal credentials.

Basic

List every service that sends as your domain. Check the one SPF record, provider DKIM settings and DMARC record. Assign a DNS owner before changing anything.

Strong

Enable provider-generated DKIM and check alignment in received message headers. Monitor DMARC reports, repair legitimate senders, then move toward quarantine or reject after evidence supports it.

Best

Maintain an authorized sender register and watch delivery after changes. Protect unused domains with provider-reviewed no-send records. Have a rollback plan.

Tools and resources: dig or nslookup; your mail provider’s admin console; received-message headers. These are inspection methods available at no cost; administration and some reporting features can require a paid plan.

Evidence: DNS answers plus a redacted test message showing SPF/DKIM/DMARC results and alignment. A DNS lookup alone cannot prove mail delivery.

Source principle: FTC Cybersecurity for Small Business, Email Authentication section — https://www.ftc.gov/business-guidance/small-businesses/cybersecurity#email-authentication

Devices, encryption and updates

A lost device or unpatched app can put work files and saved sessions at risk.

Basic

List computers, phones and routers. Turn on supported automatic updates, screen lock, firewall and available device encryption. Back up recovery keys securely.

Strong

Use supported software, check encryption status and update results, and use standard user accounts for daily work. Separate guest Wi-Fi; disable unnecessary router remote access.

Best

Review device coverage and exceptions, retire unsupported systems, test lost-device procedures and document who responds to security alerts.

Tools and resources: Built-in OS update panels, firewall and encryption status; FileVault on macOS and Windows device encryption where supported. Some Windows editions need an upgrade for BitLocker features.

Evidence: An inventory with OS support, update date and encryption state. Do not include serial numbers or recovery keys in a public report.

Source principle: CISA Secure Our World — https://www.cisa.gov/secure-our-world/update-software

Backups and restore tests

A backup matters when you can retrieve usable work after deletion, damage or an account takeover.

Basic

Identify essential files and apps; set a backup frequency based on how much work you can afford to lose. Keep a disconnected or otherwise isolated copy.

Strong

Restore a harmless sample into a separate folder and check it opens. Record the time and result; protect backup access separately from everyday work.

Best

Rehearse recovery of a critical workflow, including software, permissions and dependencies. Use offline or immutable copies where practical, and compare results to your recovery goals.

Tools and resources: Time Machine or OS backup utilities; a local timer and test log. External drives and cloud backup capacity are not necessarily available at no cost. Sync alone is not an independent backup.

Evidence: A dated restore log identifying the test file, successful open, elapsed time and a follow-up issue.

Source principle: NIST CSF 2.0, PR.DS and RC.RP — https://doi.org/10.6028/NIST.CSWP.29

Payments and wire-fraud call-backs

Urgent instructions and changed bank details can redirect legitimate payments.

Basic

Pause new or changed payment instructions. Call the payee using a trusted number already on file, not one supplied in the request. Record the confirmation without banking details.

Strong

Require a second authorized approver for sensitive payments and bank-detail changes. Give anyone permission to stop a suspicious request; use a hosted payment provider for card collection.

Best

Practice a fake bank-detail change and document the stop decision. Review exceptions, provider responsibilities and incident contacts; remove unnecessary stored payment data.

Tools and resources: A phone, existing vendor contact directory and a protected call-back log. Existing bank alerts may help; transaction fees and dual-approval features vary.

Evidence: A redacted sample approval and call-back record, showing the trusted source of the number and who approved.

Source principle: NIST Phishing guidance — https://www.nist.gov/itl/smallbusinesscyber/guidance-topic/phishing

Phishing, deepfakes and AI voice cloning

A familiar voice, face or display name does not establish who is asking.

Basic

Pause requests involving money, credentials or confidential files. Open the known app or site yourself and verify through a separate trusted channel.

Strong

Agree on a family or team emergency verification routine. Treat a code word as an extra clue, not proof; do not share one-time codes or approve unexpected sign-ins.

Best

Rehearse a voice-clone or fake meeting request without collecting real secrets. Review how the request was checked and how it was reported; improve the process without shaming people.

Tools and resources: Built-in report-phishing buttons, a trusted contact directory and the FTC’s consumer guidance. No paid deepfake detector is necessary for the verification routine.

Evidence: An exercise record showing the separate verification channel and reporting path.

Source principle: FTC Scammers use AI to enhance their family emergency schemes — https://consumer.ftc.gov/consumer-alerts/2023/03/scammers-use-ai-enhance-their-family-emergency-schemes

AI tools and agents

An assistant connected to files or business systems can act beyond what you intended.

Basic

Keep an approved-tool list, name an owner and define data that must stay out. Review provider retention and training terms; use synthetic examples for learning.

Strong

Grant each agent only the files, tools and actions it needs. Start read-only; log actions with sensitive fields excluded. Require human approval before sending, spending, deleting or changing access.

Best

Test misleading instructions embedded in a harmless document. Verify the agent stops at its boundaries, that approvals cover the exact action, and that access can be revoked quickly.

Tools and resources: A local tool register, permission settings, existing audit logs and a manual approval checklist. Enterprise retention controls and log retention may require paid tiers.

Evidence: A permission review, redacted action log, approved-action example and successful revocation test.

Source principle: NIST AI Risk Management Framework — https://www.nist.gov/itl/ai-risk-management-framework

Vendors and managed IT providers

A provider with privileged access can affect your business even when your own devices are protected.

Basic

List providers, data shared, access and business dependence. Ask who owns security, how incidents are reported and how you recover or export your data.

Strong

Request relevant SOC 2 evidence and a penetration-test summary under appropriate confidentiality terms. Review scope, report period, exclusions and remediation with qualified help.

Best

Review standing admin access and subcontractors; write notification, deletion and exit expectations into reviewed agreements. Rehearse export and access removal for a critical provider.

Tools and resources: A spreadsheet, provider trust centers, access dashboards and a written questionnaire. Evidence is not always publicly available; professional assurance reviews can cost money.

Evidence: A dated vendor review with scope, unresolved questions, risk owner and a follow-up date. A badge is not a guarantee.

Source principle: NIST CSF 2.0, GV.SC — https://doi.org/10.6028/NIST.CSWP.29

Website security and privacy

A working page still needs safe configuration, data restraint and honest privacy notices.

Basic

Inventory owned domains, renewal owners, hosts and forms. Confirm valid HTTPS/TLS and supported software. Remove unused integrations and identify data collected, cookies and trackers.

Strong

Review security headers; test a CSP in report-only mode before enforcement. Keep privacy disclosures accurate. Assess cookie consent, Do Not Sell or Share and Global Privacy Control duties with qualified advice.

Best

Review renewals, subdomains, dependencies and actual browser requests after changes. Apply an enforcing CSP and HSTS only after compatibility checks; test applicable consent and opt-out behavior.

Tools and resources: Browser DevTools Network/Security panels; dig; curl; openssl; the host’s header settings. Public analyzers contact and may publish the target: use only with owner approval.

Evidence: A dated header capture, certificate observation, browser request inventory and documented privacy applicability review.

Source principle: MDN Content Security Policy — https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CSP ; California DOJ CCPA — https://oag.ca.gov/privacy/ccpa

Incident response and recovery

A written first move reduces confusion when ordinary communication or accounts stop working.

Basic

Name a response lead and backup, keep trusted contacts available offline, and identify how to reach your bank, IT provider and insurer from a clean device.

Strong

Practice a tabletop: isolate an affected device from the network when safe, preserve evidence, use clean communications and get qualified response help. Do not wipe devices as a first reflex.

Best

Rehearse containment and recovery decisions, record a timeline and review lessons. Have counsel assess notification duties and the insurer explain reporting and consent conditions.

Tools and resources: A printed contact tree, local incident log and tabletop prompts. Professional incident response and legal services are not available at no cost.

Evidence: An offline contact check and dated exercise record with decisions, owners and corrective actions.

Source principle: NIST CSF 2.0, RS and RC — https://doi.org/10.6028/NIST.CSWP.29

Cyber insurance and truthful applications

Insurance can help transfer defined losses, but it does not replace working controls.

Basic

Discuss business exposures with a licensed broker. Answer applications from observed evidence; mark unknowns honestly and keep a dated copy of submitted answers.

Strong

Review limits, retention, exclusions, waiting periods and social-engineering or funds-transfer conditions. Ask about incident notification, approved providers and consent before spending.

Best

Reconcile renewals with actual practices and control changes. Model a business interruption scenario with qualified help and document gaps, sublimits and decisions.

Tools and resources: FTC’s cyber insurance guide; a policy comparison worksheet and application evidence register. Policies, broker services and advice can involve fees.

Evidence: A private comparison of actual policy language with questions answered by the broker; no quote is a promise of coverage.

Source principle: FTC Cyber Insurance — https://www.ftc.gov/business-guidance/small-businesses/cybersecurity/cyber-insurance

Training, ownership and ongoing review

Habits survive when people know what to do, who owns the task and how to ask for help.

Basic

Name a security owner and train everyone, including contractors and volunteers, on the verification and reporting routines. Make reporting safe and supportive.

Strong

Use short role-specific practice for finance, admins and public-facing staff. Review access when people join, change roles or leave; keep a small fix list with owners.

Best

Repeat exercises after meaningful changes, check the quality of evidence and review overdue risks with leadership. Adapt the same routines for families and shared household accounts.

Tools and resources: CISA awareness materials, a local training log and a calendar reminder. Suggested review schedules are planning choices, not universal legal requirements.

Evidence: A dated attendance and practice log plus an owner and next review date for each open action.

Source principle: CISA Secure Our World — https://www.cisa.gov/secure-our-world/recognize-and-report-phishing