🔹 A. Assess Your Risks

• Identify key assets: customer data, financials, IP, devices

• Understand threats: phishing, ransomware, human error, data loss

• Use a basic cyber risk assessment checklist to start

🔹 B. Baseline IT Hygiene

• Ensure all devices are:

  • Running Windows 10/11 Pro or up-to-date macOS

  • Using current antivirus software

  • Free from unused software

• Enforce strong password policies and regular updates

🔹 C. Cloud Configuration & M365 Setup

• Use Microsoft 365 Business Premium

  • Includes Office apps, Intune, OneDrive, SharePoint

  • Exchange Online Protection (email filtering)

• Enforce Multi-Factor Authentication (MFA)

🔹 D. Device Management

• Enroll devices in Intune

  • Apply security policies (BitLocker, antivirus, lock screen)

  • Require compliant devices for access

  • Enable remote wipe/lock

🔹 E. Email & Phishing Protection

• Enable Advanced Threat Protection (ATP)

• Use Safe Links and Safe Attachments

• Provide monthly phishing awareness training

• Set up admin alerting for suspicious activity

🔹 F. Firewall & Network Setup

• Use a business-grade router/firewall

  • Ubiquiti, Fortinet, WatchGuard recommended

  • Configure VLANs for separation

  • Auto-update firmware

• Add DNS-level filtering (e.g., Cisco Umbrella)

🔹 G. Govern Data Access

• Apply least privilege principle

• Use role-based access controls

• Audit data access quarterly

🔹 H. Have a Backup Plan

• Implement cloud-to-cloud backup for Microsoft 365 (Acronis, Spanning)

• Back up key files to an encrypted external drive monthly

• Test data recovery every 6 months

🔹 I. Incident Response Plan

• Draft a simple breach response playbook

  • Define who, what, when, how

• Assign key response roles

• Include contact details for IT support and authorities

🔹 J. Join External Support Networks

• Subscribe to national cyber threat alerts (e.g., CERT NZ, ACSC)

• Join online small business IT security forums

🔹 K. Keep Everything Up to Date

• Enable auto-updates on:

  • Windows/macOS

  • Office 365

  • Routers/firewalls

  • Third-party software

• Run monthly patch reviews

🔹 L. Legal & Compliance

• Publish a Privacy Policy and IT Use Policy

• Ensure compliance with Privacy Act, GDPR (if applicable)

• Add disclaimers and security notices to email footers

🔹 M. Monitor & Improve

• Use Microsoft Secure Score for ongoing assessment

• Review logs: sign-ins, access, compliance issues

• Perform quarterly audits and policy reviews

🔹 Optional Enhancements

• Add Endpoint Detection & Response (EDR)

• Deploy a Password Manager (e.g., Bitwarden, 1Password)

• Consider Cyber Insurance

• Use Security Awareness Training (e.g., KnowBe4)