A Practical Cybersecurity Starting Point for a Growing Business
Start with critical systems and accountable owners. Protect access, maintain devices, test recovery, and give employees a clear way to report problems.
- Identify what the business depends on
- Review access to important accounts
- Make maintenance someone's responsibility
- Verify that recovery works
- Prepare people to report and respond
- Build a review the team can sustain
Identify what the business depends on
Begin with the accounts, devices, applications, services, and data needed to keep the business operating. An inventory helps connect technical work to business consequences. Record an owner for each important asset and describe what would happen if it became unavailable or exposed.
In a fictional design studio, the first list might include business email, project files, billing software, the website, and staff laptops. This example is deliberately small. The aim is to create a useful starting point that the team can maintain.
Review access to important accounts
Enable multifactor authentication where supported, starting with sensitive and administrative accounts. Use unique passwords and a suitable password manager. Review who can access business information, remove accounts that are no longer needed, and limit privileges to the work each person performs.
For the fictional studio, an access review could reveal that a former contractor still has a shared folder invitation. Record who removes it and how completion is checked. Include account recovery methods in the review so control of an important account does not depend on an unavailable person.
Make maintenance someone's responsibility
Assign responsibility for software updates, device protection, and the settings used on business equipment. Maintain supported software and apply patches regularly. Use device encryption where appropriate, particularly for laptops carrying business information.
Keep a simple record of coverage and exceptions. If an older application cannot be updated immediately, document why, who owns the issue, and the next action. An instruction to "keep everything secure" gives staff little help in deciding what to do on a busy working day.
Verify that recovery works
Back up critical data and test restoration. CISA recommends offline, encrypted backups and regular checks of their availability and integrity. Accessible backups can also be affected during a ransomware incident, so the design needs to consider how copies are protected.
Choose a representative file or system for a controlled restoration test. Record whether it opened correctly, what was missing, who performed the test, and how long the process took. For the studio example, a completed backup notification would not establish that a project folder can be recovered.
Prepare people to report and respond
Give employees a clear contact for suspicious messages, unexpected login prompts, lost devices, and unusual system behaviour. Provide practical training using situations they encounter. A report should reach someone who can assess it and decide the next action.
Write a basic response plan before an incident. Identify the business lead, technical contact, responsibilities, and communication process. Keep necessary contact details available if normal email or file access is unavailable. Decide which services the business would need to restore first.
Build a review the team can sustain
Use a short action list with four fields: task, owner, evidence, and review date. For the fictional studio, initial entries could cover email MFA, contractor access, laptop updates, and a file restoration test.
Revisit the list when staff, suppliers, or systems change. These measures support an ongoing risk management process. The useful first outcome is a clear picture of priority gaps and who is responsible for addressing them.
Further reading
Primary references behind the technical guidance in this article.
Put the thinking into practice.
Explore our cybersecurity services, or talk to us about the task you want to improve.
Explore the service
