Cyber security starts with everyday administration: who can sign in, which devices are maintained and whether important information can be recovered. A business does not need to begin with an extensive shopping list. It needs a clear view of its environment and someone responsible for keeping the fundamentals working.
1. Protect account access with MFA
Multi-factor authentication adds a check beyond a password. Prioritise business email, administrator access, remote access and important cloud applications. Use phishing-resistant methods where supported and appropriate, and provide staff with clear enrolment and recovery instructions.
Do not stop at telling people to turn it on. Check which accounts are actually covered, investigate exceptions and remove stale access. Staff should know not to approve unexpected sign-in prompts. Recovery methods also need protection because they can become an alternative path into an account.
2. Maintain operating systems and applications
Updates address faults and security weaknesses, but an update policy is only useful when installation succeeds. Keep a device and software inventory, schedule updates around business needs and follow up on machines that remain offline or report errors.
Include browsers and business applications as well as the operating system. Review unsupported software and hardware rather than assuming an old system can be maintained indefinitely. Where an application cannot be updated immediately, record the reason, the temporary controls and a plan for resolution.
3. Manage endpoint protection
Computers need suitable protection that remains enabled, current and visible to whoever manages IT. An installed product is not the same thing as a monitored control. Agree who reviews alerts, how suspicious activity is investigated and when the business is contacted.
Endpoint protection works alongside secure configuration, patching and user awareness. It does not guarantee that a device cannot be compromised. Device encryption and sensible screen-lock settings can also reduce exposure when equipment is misplaced or accessed by someone else.
4. Give people the access they need
Use individual accounts and grant permissions according to the person’s work. Restrict administrative privileges to situations that need them. A staff member who processes invoices should not automatically receive access to every confidential folder or system setting.
Review access when roles change and when people leave. Include contractors, old supplier accounts and applications connected to the business tenant. Keep a secure record of ownership and recovery access so the company is not dependent on a forgotten password or an unavailable former employee.
5. Make recovery a practical capability
Identify the files, cloud services, configurations and records that matter to operations. Define how much recent work the business could afford to lose and how long it could operate without those systems. Those answers should guide the backup arrangement.
Backups need appropriate separation and access protection so a problem with the primary environment does not automatically affect every recovery copy. Check job failures and test restoration. A successful backup notification does not prove that a full business process can be recovered within the time available.
Turn the basics into routine work
Assign an owner to each control and record what is implemented, what remains unresolved and when it will be checked again. Staff need a simple way to report suspicious messages or unusual behaviour without delaying because they are unsure who to contact.
These five areas are a foundation, not a complete assessment or a claim of compliance with a framework. The right controls depend on the business, its applications and the information it handles. Nexxiv’s cyber security approach centres on configuration, maintenance and practical risk reduction.
Further reading: ASD’s ACSC small business cyber security handbook; Microsoft MFA guidance.