01
Patching
"Most breaches exploit weaknesses that are already known about. Listing what you own and keeping it up-to-date closes the easiest door for attackers."
01
We have a list of every laptop and desktop.
02
We know every server we own.
03
We know every network device connected.
04
We know every application installed.
05
Unsupported software has been removed.
06
Windows updates are installed monthly.
07
Third-party software is updated monthly.
08
Computer firmware is updated regularly.
09
Users do not have administrator rights on their computers.
10
We run vulnerability scans regularly.
02
Passwords
"Most hackers don't break in - they log in. Strong, unique passwords with MFA stops over 99% of automated attacks."
01
Every user has their own account - there are no shared accounts.
02
When people leave the business, their accounts are disabled immediately.
03
Multi Factor Authentication is used on our email accounts.
04
Multi Factor Authentication is enabled on all cloud systems we use.
05
We use passphrases.
06
Users are trained to recognise password phishing.
07
We use a password manager to create and store passwords.
08
Administrators have separate accounts for admin work.
09
Emergency ('break-glass') accounts exist.
10
Accounts are reviewed regularly.
03
Backups
"If prevention fails, recovery is everything. Good backups turn a business-ending event into a bad afternoon."
01
We are clear on which systems are Business Critical.
02
A Business Impact Analysis has been completed.
03
Our important data is backed up at least daily.
04
Multiple versions of backups are saved.
05
One copy is kept offline or off your network.
06
We perform regular restoration testing of our backups.
07
Recovery times are documented.
08
We have a documented Incident Response Plan for cyber security incidents.
09
Staff know who to contact in an emergency.
10
Recovery priorities are documented.