Start at the top and work down. Each item reduces risk.
Priority 1: Non-Negotiables
- MFA everywhere. Authenticator apps, not SMS.
- Endpoint protection. Including Macs.
- Automated backups. Daily, offsite, tested quarterly.
- Email filtering. Anti-phishing and malware.
Priority 2: Foundational
- Full disk encryption. FileVault / BitLocker.
- Password manager. 1Password or Bitwarden.
- Patch management. Automated.
- Firewall. Business-grade, guest WiFi isolated.
Priority 3: Maturity
- Security training. Phishing simulations.
- Incident response plan.
- MDM.
- Cyber insurance.