01
Know your accounts and administrators
Keep an inventory of business-critical services, the account owner, and the people who have administrative access. Make sure recovery information belongs to the business where appropriate.
02
Use strong authentication
Use unique passwords and a reputable password manager where appropriate. Enable multifactor authentication on supported accounts, especially email, cloud administration, and financial systems. Protect recovery codes separately.
03
Keep devices and software updated
Use supported operating systems and applications. Plan updates around critical work and identify the person responsible for checking that important updates complete.
04
Make suspicious messages easy to report
Tell staff whom to contact if they see an unexpected sign-in prompt, a payment request, or a questionable attachment. Verify unusual instructions through a separate known channel before acting.
05
Review access when people change roles
Remove access that is no longer required, recover business equipment, and transfer ownership of shared work. Avoid shared administrator accounts when individual accounts are available.
06
Know when to get help
If you suspect an account or device is compromised, stop interacting with the suspicious prompt and contact your authorized IT support. Explain what you observed without forwarding sensitive credentials.