Use a small set of owned, checked practices to improve security readiness. Account access, supported systems, information handling and recovery need to work together.
Know what needs protection
List the accounts, devices, applications and important information used in everyday work. Identify the tasks that would stop if a service was unavailable and the people authorised to make changes. Include external suppliers so responsibility gaps do not remain hidden.
Keep the record practical and controlled. It should help an authorised person respond when a colleague is absent, without becoming a publicly shared list of credentials or sensitive configurations.
Review access and recovery
Use named accounts and permissions suited to each role. Plan appropriate MFA and recovery methods for important services, and remove access when it is no longer needed. Test the legitimate recovery route rather than assuming someone remembers how the account was configured.
Read our MFA rollout guide for method and recovery considerations. MFA improves a layer of protection; it does not remove risks from compromised devices, sessions or excessive permissions.
Maintain supported devices and software
Assign update and maintenance responsibility. Use approved devices and tools for business information, and check important changes with a suitable recovery route. A product being installed is not evidence that it is configured and maintained correctly.
For shared or personal devices, define what use is permitted and who can support it. Keep device encryption, screen locking and account access in the same discussion.
Make reporting and verification easy
Tell staff how to report a suspicious message, lost device or unusual request. Sensitive actions such as payment changes should have an established verification route. Awareness and practical business processes support technical controls rather than replace them.
An illustrative readiness check asks whether a staff member knows whom to contact if business email is unavailable. Fix an unclear answer before a real incident forces an improvised process.
Test restoration and revisit the plan
Confirm backup coverage and test a representative recovery. Record required credentials, suppliers and replacement systems. Define the incident lead and appropriate external support contacts, and review the arrangement after material changes.
Use current ACSC business guidance and advice appropriate to the actual environment. Zenexa’s cybersecurity scope explains the initial conversation; this general checklist does not establish compliance, certification or immunity from incidents.
