Protect accounts and devices
Use unique passwords, multifactor authentication, supported software, automatic updates and limited administrator access.
- Require multifactor authentication
- Update software promptly
- Remove unused accounts
Protect data and vendors
Know which sensitive information the business holds, why it is needed, where it lives and which vendors can access it.
- Keep only needed data
- Encrypt appropriate information
- Review vendor security
Prepare for incidents
Maintain tested backups and a written response plan covering responsibilities, containment, recovery, communication and legal obligations.
- Test data restoration
- Document key contacts
- Practice the response plan
