Security briefing
Prepared for leadership · First 30 days
Overall posture: needs attention
The basics are partly in place. Three gaps would turn a routine phishing email into a business interruption. All three can be closed within 60 days using tools the business already pays for.
Priorities, ranked by business impact
Email account takeoverHigh
- Finding
- About a third of mailboxes, including finance and the owner's, have no multi-factor authentication.
- Why it matters
- A taken-over finance mailbox is the usual route to invoice fraud, and to resetting every other account that uses email.
- Decision
- Require multi-factor authentication on every mailbox, with no exceptions.
- Owner
- Operations lead
- Next action
- Turn it on for finance and leadership first, then all staff, with a short walkthrough.
- Evidence it's done
- An admin report showing it enforced on every account, attached to the next briefing.
- Due
- Week 2
Backups never test-restoredHigh
- Finding
- Backups run nightly, but nobody has restored from them, so recovery time is unknown.
- Why it matters
- Recovery from ransomware depends on backups that actually restore. Untested, they are a hope rather than a plan.
- Decision
- Run a restore test every quarter and record how long it takes.
- Owner
- Office manager, with the outside IT provider
- Next action
- Restore one shared folder and one mailbox to a test location.
- Evidence it's done
- A restore log with the time taken.
- Due
- Week 3
Former staff still have accessMedium
- Finding
- Three former employees' accounts are still active in two cloud apps.
- Why it matters
- Unused accounts are an easy way in, and nobody notices them day to day.
- Decision
- Remove access on the last day, every time, from a written checklist.
- Owner
- HR lead
- Next action
- Disable the three accounts today and adopt the offboarding checklist.
- Evidence it's done
- A completed checklist for each departure, and a quarterly access review.
- Due
- Week 1
What’s working
- Laptops and phones install updates automatically.
- Leadership uses a password manager.
- The website's security certificate and software are current.
Decisions needed from leadership
- Approve multi-factor authentication on every mailbox, with no exceptions.
- Name one owner for reviewing which vendors can reach company data.