A practical starting point informed by NIST, CIS and NCSC guidance. Adapt it to your risks and duties. It does not certify compliance with a standard.
How to use this guide
These practical controls support the micro policy. The business owner and a competent IT support person should work through them together. Include phones, cloud accounts, websites and supplier access, not only office computers.
The timeframes below are suggested starting targets for a small team, not deadlines imposed by NIST, CIS or a law. Tighten them for sensitive information, high-risk systems or contractual duties. Record who will do each task, its due date and how you checked it.
1 Put someone in charge
Name an owner, security lead and backup contact. Keep their contact details available offline. Record the systems and data the business cannot work without, the main risks and the people authorised to approve changes.
Keep a simple action list with the risk, action, person responsible, due date and completion evidence. Review it monthly. Check supplier contracts, insurance conditions and applicable data-protection duties with suitable advice.
2 Know your devices accounts and data
List laptops, phones, servers, network devices, payment systems, websites, cloud services and important software. Record the owner, purpose, version, support end date and where each item is used. Review the list monthly and when something changes.
List business accounts, administrators, service accounts and supplier access. Identify where important information is stored and shared. Keep licence keys, passwords and recovery codes in restricted storage, not in a general inventory.
3 Secure sign-ins and account recovery
Turn on MFA for all services that support it, prioritising email, administrators, remote access, banking, backups, domain registration and cloud storage. Prefer phishing-resistant passkeys or security keys. Where unavailable, use an authenticator app with number matching where supported; an SMS code is a fallback, not the preferred method.
Use an approved business password manager. Set a default minimum of 15 characters where supported and a unique password for every account. Let the manager create random passwords. Where the business controls sign-in settings, block common and known stolen passwords, permit long passphrases, and avoid forced character mixtures or routine password changes without a reason.
Turn off old sign-in methods that bypass MFA, after checking business dependencies. Keep recovery codes and encryption recovery keys restricted and accessible to an authorised backup person. Verify identity before resetting access; test recovery without leaving an unprotected route into the account.
4 Give people only the access they need
Use named accounts and separate administrator accounts. Do not use administrator access for email or normal browsing. Grant access by job role and obtain approval before granting extra rights.
Check access at least quarterly and after job changes. Disable departing staff and supplier access at the agreed departure time, revoke sessions and tokens, remove registered sign-in methods, recover equipment and transfer work. Disable unused accounts and remove access that has expired.
5 Keep systems supported and updated
Enable automatic updates for supported operating systems, browsers, apps, routers, firewalls and website software where safe. Check at least weekly that installation succeeded; a pending restart is not a completed update.
Treat a vulnerability being actively exploited, especially on an internet-facing system, as urgent. Apply the vendor’s fix or mitigation as soon as possible; disconnect or restrict an exposed service if it cannot be protected. For routine security updates, aim for completion within 14 days, with a shorter target for higher risk.
Replace unsupported systems or isolate them under a time-limited plan approved by the owner. Back up and test important changes, record the result and keep a rollback method. Do not postpone a serious fix merely to wait for a routine maintenance window.
6 Protect computers and phones
Enable supported malware protection with real-time checks, automatic updates and alerts that someone receives and acts on. Use scheduled scans as the vendor recommends; scans do not replace real-time protection.
Turn on device encryption and the host firewall. Store recovery keys securely. Require a strong device unlock method and an automatic screen lock after a short idle period, for example five minutes. Prevent staff from installing unapproved software.
Require approval before a personal device handles business data. Set minimum security rules, separate work data where possible and agree what business information can be removed if the device is lost or the person leaves. Securely erase or destroy storage before disposal.
7 Secure networks and remote access
Change default router and device credentials, keep firmware supported and disable unnecessary services. Use WPA3 Wi-Fi, or WPA2 with strong encryption where WPA3 is unavailable. Keep guest and untrusted smart devices separate from business systems.
Do not expose remote desktop or management screens directly to the internet. Use an approved, updated remote-access service with MFA and restricted permissions. Turn supplier access off when the work ends. Check firewall rules and remote-access accounts quarterly.
8 Protect email websites and cloud services
Use a supported business email service with spam, phishing and malware protection. Where you control the domain, configure SPF and DKIM to identify authorised mail and use DMARC reporting. Check legitimate senders before moving DMARC to quarantine or reject.
Check for unexpected mailbox forwarding, inbox rules, connected apps and administrator changes. Restrict public file sharing; use named recipients, expiry dates and the minimum permissions needed.
Protect website, hosting, DNS and domain accounts with MFA, renewal ownership and recovery contacts. Use HTTPS, update plugins and remove unused ones. Check cloud security settings and take responsibility for the information you store there; a provider does not handle every security task for you.
9 Protect information throughout its life
Decide what information is public, internal or sensitive. Collect only what is needed and store it in approved locations. Restrict sensitive data, encrypt it in storage and transfer, and check access when sharing changes.
Set a written retention schedule based on business needs and relevant duties. Remove old files and public links securely, including from retired devices and suppliers. Keep information subject to a valid preservation requirement.
Approve AI tools before business use. Do not enter customer details, passwords, confidential documents or source code into an unapproved tool. Review generated output before relying on it or sending it to others.
10 Make backups that can actually restore work
Identify essential files, email, business applications, website content and system settings. Decide the maximum acceptable data loss and downtime for each. Back up often enough to meet those needs; daily is a useful starting point for frequently changing data, and some systems need hourly or continuous backups.
Keep multiple copies in separate failure locations, including an off-site copy and a copy that is offline or protected against change and deletion. Use encryption, MFA and separate restricted backup administration. Confirm that cloud sync alone does not replace a backup with suitable recovery history.
Check failures each working day. Keep several dated versions, with retention long enough to recover from delayed discovery of an incident. Do not automatically delete older backups just because three new copies succeeded.
Test a sample restore at least quarterly, after important changes and as part of a planned full recovery exercise. Record what restored, the time taken and any gaps. Include encryption keys and account recovery in the test.
11 Watch for problems and act on alerts
Enable useful security records for sign-ins, failed access, administrator actions, MFA changes, file sharing, mailbox rules and malware detections. Keep clocks accurate, protect logs against changes and limit who can view them.
Send high-risk alerts to a named person and backup contact. Act on urgent alerts promptly and review outstanding alerts each working day. Do not wait for a quarterly log review to investigate suspicious activity.
Choose log retention based on likely investigation needs, privacy, contracts, provider limits and storage. Aim for at least 90 days where feasible as a starting target, and extend it when the risks or duties require it. Keep incident evidence until the authorised investigation and retention requirements are met.
12 Prepare people and prevent payment fraud
Give security guidance before granting access and refresh it at least yearly, with brief reminders when scams or processes change. Cover suspicious messages, QR codes, unexpected MFA prompts, safe sharing, lost devices and reporting mistakes.
Use a known phone number or other established channel to verify payment-detail changes and unusual transfers. Require a second authorised approval for higher-risk payments where staffing permits. If that is not practical, the owner must independently verify the request before payment.
13 Keep an incident and recovery plan
Write a short plan naming who leads, who contacts IT support, how to report outside business hours and how to communicate if email is unsafe. Keep offline contact details for suppliers, the bank and insurer.
Contain affected devices and accounts with competent help, preserve relevant messages and records, and record decisions and times. Reset compromised access and revoke sessions from a known clean device. Do not wipe or rebuild systems before considering evidence needs.
The owner obtains suitable advice on notifications and reporting duties. For suspected payment fraud, contact the bank immediately using a known number. Restore from a checked, clean backup only after the cause is addressed. Test the plan at least yearly and improve it after an incident.
14 Check suppliers and important dependencies
Before a supplier handles information or manages systems, check their security, MFA, backup responsibilities, support arrangements and incident-reporting terms. Agree how the business gets its data back or deletes it when the relationship ends.
Know who controls the domain, cloud tenant, backups and licences. Avoid arrangements where one supplier or one person is the only route to essential access. Review important suppliers yearly and when their services change.
15 Test the controls and keep evidence
Arrange risk-based vulnerability checks and review cloud settings with competent support. Test after significant changes, prioritise serious findings and confirm that fixes work. Obtain permission before scanning or testing any system.
Review the controls at least yearly and after an incident. Keep useful evidence such as MFA settings, update reports, access reviews, restore-test records and training attendance. Record any exception with its risk, compensating measures, owner and expiry date.
A simple order for getting started
Start now: name the security lead, secure important accounts with MFA, check backups and updates, and make sure staff know how to report an incident.
Then work through access, devices, email, networks, data and supplier checks. Use a monthly action list to close gaps. Sensitive data, regulated services, software development or unusual risks may need additional controls and professional advice.
Guidance used
These guides inform this toolkit. The practical frequencies and targets above are suggested business choices, not a complete mapping to every safeguard.
Use the updated toolkit
The editable Word downloads contain the same guidance as these pages.
Download policy ↓ Download controls ↓