How to build a cyber security plan for the first 90 days

Most small and medium-sized businesses know they need to improve their security, but get stuck when it comes to starting. The list of recommendations seems endless, suppliers offer every kind of product and day-to-day business always has something more urgent. A 90-day plan helps turn intention into practice: it breaks the work into short stages, prioritises what reduces the most risk and creates a routine that carries on after the third month.

Before you start: owner, scope and reference

Three decisions stop the plan from losing its way:

• An owner: someone in management who oversees the plan, even if the technical work is carried out by a supplier. Without an owner, tasks get diluted.
• A clear scope: which offices, computers, cloud services and systems are included. Laptops used for home working and phones that access the business email also count.
• A reference: following a recognised model avoids reinventing the wheel. Cyber Essentials, from the UK's NCSC, is a good basis for SMEs because it focuses on five essential technical controls. The article on Cyber Essentials for SMEs introduces the scheme.

Days 1 to 30: get to know your environment and close the most obvious gaps

The first month is about taking stock and making quick fixes, which require little investment and reduce exposure considerably.

Inventory

List your equipment (computers, servers, routers, company phones), your systems and cloud services, and who has access to each one. A simple spreadsheet will do. You cannot protect what the business does not even know it has.

Immediate actions

• turn on two-factor authentication for business email and the main cloud services;
• disable accounts belonging to former employees and generic accounts that nobody uses;
• change the default passwords on routers, printers and other devices;
• check that the backup is running and that it includes critical data;
• confirm that every computer has active malware protection.

By the end of the month, the business should have a reasonable picture of its environment and a prioritised list of outstanding tasks.

Days 31 to 60: put the basic controls in place

With the inventory in hand, the second month is dedicated to the controls that take a little more work.

Updates

Turn on automatic updates wherever possible and set up a routine for anything that does not update itself, such as router firmware and business management systems. Hardware and software no longer supported by the manufacturer need a replacement plan. The article on security updates covers this control in detail.

Accounts and privileges

Review who has administrator rights. For everyday work, users should use standard accounts, and administrative access should be restricted to those who genuinely need it, using separate accounts.

Firewall and configuration

Check the rules on the router or firewall, close services exposed to the internet that are not needed and review remote access. Remove software and accounts that come installed by default and are not used.

Backup with separation

Make sure at least one copy is kept offline or in immutable storage, and carry out your first restore test.

Days 61 to 90: people, response and routine

The third month consolidates what has been done and prepares the business to deal with problems.

• Training: a short conversation with the team about fraudulent emails, scams involving changed bank details and password use. Real examples from your sector work better than theory.
• Incident plan: a single page with emergency contacts and the first actions to take. The article on the first 30 minutes of an incident can serve as a starting point.
• Personal data: identify where customer and employee data is held and who is responsible for it, bearing in mind obligations under the UK GDPR as well.
• Minimum policies: short rules on passwords, the use of personal devices and the granting of access.
• Review schedule: decide when each control will be reviewed.

After 90 days

The plan does not end on day 90. It creates a foundation that needs to be maintained. Some routines that work well in SMEs:

1. Monthly: check backup reports, antivirus alerts and pending updates.
2. Quarterly: review accounts and access, test a restore and update the inventory.
3. Annually: reassess all controls, repeat the training and review the incident plan.

No plan makes a business immune to attacks. What it does is reduce exposure to the most common risks and improve the ability to respond, and that alone is a significant change in information security for SMEs.

90-day checklist

• Owner and scope defined.
• Inventory of equipment, systems and access completed.
• Two-factor authentication active on email and cloud services.
• Old accounts disabled and default passwords changed.
• Automatic updates turned on and a plan in place for unsupported items.
• Administrator privileges reviewed.
• Firewall reviewed and unnecessary services closed.
• Backup with an offline or immutable copy, and a restore tested.
• Team trained and incident plan distributed.
• Review schedule defined.