The checklist asks the question. This page says who answers it.
Companion to the Cyber Security Readiness Checklist.
Numbering follows the checklist exactly. Some lines we deliver and manage. Some are a joint track where we bring the technical work and you bring the decisions. A few are genuinely yours, and we would rather say so than imply a tool covers something a tool cannot.
Multifactor authentication on every account, with no exemptions.
Older sign-in methods disabled, and sign-in rules applied.
Mail filtering on links and attachments, plus published sender records.
Security awareness training with regular simulated phishing.
Updates on a schedule, for applications as well as operating systems.
Administrator accounts kept separate from everyday accounts.
Control over what software and remote access tools may be installed.
Endpoint detection with trained analysts watching around the clock.
Monitoring of the identity platform itself, not only the devices.
Logs collected centrally and kept long enough to be useful.
A known escalation path outside business hours.
Regular access reviews, with unused accounts and stale rights removed.
Backups that cannot be altered or deleted, with their own credentials.
Cloud mail and file data backed up independently of its platform.
A periodic offline copy kept away from the network.
Restores tested by actually restoring, with a known recovery time.
Printed copies of what is needed to operate with no systems at all.
A written incident response plan, with named roles and named backups.
The plan tested in a tabletop exercise and updated afterward.
Cyber insurance reviewed, with the carrier as the first telephone call.
A relationship with a breach attorney established in advance.
Prepared wording for staff, clients and any regulator that applies.
Sensitive data you no longer need identified and removed.
Questions about any of these lines?
Call or email, and tell us which line number you are asking about.
Capabilities, not a scope of work. Take the readiness checklist.