Most breaches we hear about industry-wide don’t involve a sophisticated attacker defeating a well-defended system. They involve a basic control that was skipped because nobody got around to it. Here’s the short list that actually matters most, roughly in order of impact for the effort involved.
Multi-factor authentication, everywhere, no exceptions
A stolen or guessed password stops being enough to get in when MFA is enabled. This is the single highest-impact control on this list, and it’s usually free. If it’s only enabled for “the important accounts,” it’s not really enabled — the compromise almost always starts somewhere considered unimportant.
Least-privilege access, reviewed on a schedule
Most accounts accumulate access over time and rarely lose it — someone changes roles, or a contractor’s project ends, and their old permissions just stay active. Review who has access to what on an actual schedule, not “whenever someone remembers.”
Backups that have been tested, not just taken
A backup nobody has ever restored from is a hypothesis, not a safety net. Schedule an actual test restore periodically. The number of businesses that discover their backups were misconfigured only after they needed them is higher than it should be.
A real patching cadence
Unpatched, known vulnerabilities remain one of the most common ways systems actually get compromised, precisely because the fix already existed and just wasn’t applied yet. This needs an owner and a schedule, not an assumption that updates happen automatically everywhere.
Logging and basic monitoring
If something goes wrong, can you actually tell what happened, when, and to what? Basic centralised logging with alerts on the obvious red flags (repeated failed logins, access from unexpected locations) turns “we have no idea” into “we caught it on day one.”
A simple incident response plan
It doesn’t need to be a fifty-page document. It needs to answer, in advance: who gets called first, who’s authorised to make decisions, and what the first three steps are. Working this out for the first time during an actual incident costs real time you won’t have.
None of this requires a large security team — it requires deciding these things are non-negotiable rather than optional. If you want a straightforward assessment of where your setup stands against this list, get in touch.