Editorial content. Not sponsored and not written by a vendor.
Foundations
- Asset inventory of devices and software
- MFA on email and remote access
- Tested, offline backups
- Patch management process
Prevention
- Endpoint protection on all devices
- Application control or allowlisting where practical
- Removal of unnecessary admin rights
Response
- Who to call during an incident
- A written incident response plan
- Contact details for your cyber insurer, if applicable
Questions to ask vendors
- Is there a small-business tier, and what are the minimum commitments?
- Does the quoted price include onboarding, support, and updates?
- Which items on our checklist does this product cover directly, and which need add-ons?