If your company lost access to email, its customer records, or a critical application tomorrow, which work would stop first? That question gives you a practical starting point for cybersecurity. It identifies the systems and accounts worth protecting first and the recovery steps you need to test.
Why cybersecurity matters
Cybersecurity protects the confidentiality, integrity, and availability of the information and systems your business depends on. A stolen administrator account can expose customer data, allow someone to change payment details, or interrupt access to services. The impact depends on what the account can reach and how quickly the team can detect, contain, and recover from the incident.
Consider a small company that uses cloud email, a shared file service, and a firewall VPN for remote work. One compromised account could lead to fraudulent email, unauthorized remote access, or access to internal files. Separate administrative accounts, strong authentication, limited network access, and usable logs each reduce a different part of that risk.
Days 1–7: Identify what the business depends on
Pick one business process, such as processing orders or supporting customers. List the systems, data, accounts, and external providers that keep it running. For each critical item, write down its owner, who can administer it, whether it is reachable from the Internet, and what happens if it fails. Include cloud services, firewalls, VPN gateways, laptops, and backups. Decide who can approve emergency changes.
Deliverable: A short inventory and a ranked list of the three issues with the greatest business impact. Record the person responsible and the next action for each issue.
Days 8–14: Protect accounts and reduce Internet exposure
Start with administrator accounts, email, remote access, and backup administration. Require MFA and prefer phishing-resistant methods such as FIDO2 security keys or passkeys where supported. Use named accounts with only the permissions they need. Review old accounts and shared credentials. Establish a documented emergency access path before enforcing new sign-in requirements.
Inventory public services, VPN portals, and management interfaces. Remove unnecessary exposure through the normal change process. Prioritize known exploited vulnerabilities on Internet-facing systems, and follow vendor guidance for patching or mitigation. For firewall changes, record the intended source, destination, service, and rule owner. Verify the effect with logs and a controlled test before closing the change.
Deliverable: A list of critical accounts with MFA status, plus a remediation owner and deadline for each exposed service or urgent vulnerability.
Days 15–21: Prove that you can recover
Choose one important application or dataset and restore it into an isolated test location. Verify that the restored data opens and that the application can use it. Record how long the restore takes and how recent the recovered data is. Compare both against the business’s tolerance for downtime and data loss. Protect backups from deletion by compromised production credentials, for example with separate administration and an offline or immutable copy where appropriate.
Deliverable: One documented restore test with the date, data recovered, time taken, owner, and follow-up actions.
Days 22–30: Make incidents visible and rehearse a response
Start with sign-in, VPN, firewall, endpoint, and backup events that relate to the critical service. Pick a few actionable signals, such as a new privileged account, unusual remote sign-ins, or repeated backup failures. Assign an alert owner and test that the alert reaches the person who can act on it.
Run a short tabletop exercise: a remote user account appears compromised. Decide who checks the logs, who can revoke sessions or isolate an endpoint, how evidence is retained, who informs leadership, and how the team confirms that service has recovered. Keep contact details and key procedures accessible during an outage.
Deliverable: A one-page incident response plan and at least one verified alert.
How to tell whether the first month worked
Track four things: the share of critical accounts protected by MFA, exposed systems with overdue critical fixes, the time required for the last successful restore, and whether a test alert reached its owner. Review gaps monthly. Use the results to prioritize the next round of improvements, such as segmentation, endpoint coverage, or vendor access controls.
References and related reading
The 30-day schedule is an example implementation plan informed by the NIST Cybersecurity Framework 2.0 Small Business Quick-Start Guide and the CISA Cross-Sector Cybersecurity Performance Goals. Adapt it to your resources, risks, and recovery needs.
For a practical follow-up on remote access, see How to Configure FortiGate Remote Access IPsec VPN with FortiClient.