Cybersecurity basics: eight measures in order of impact, and who keeps them in place

The cybersecurity basics are unglamorous, which is exactly why they get skipped. In the UK government's latest survey, phishing was by far the most common attack, experienced by 38% of businesses, yet only 47% had two-factor authentication in place (source: UK government, April 2026). The routes attackers use most are well known, and so are the measures that close them.

Four official baselines largely agree on those measures: Cyber Essentials in the UK, the Essential Eight in Australia, and CISA's Cybersecurity Performance Goals and the NIST Cybersecurity Framework in the US. Below are eight measures ranked by impact, what "done" looks like for each, and who keeps them in place.

1. 1
   Multi-factor authentication wherever you sign in from the internetMulti-factor authenticationMulti-factor authentication (MFA)Signing in with a second proof besides the password, such as a prompt in an app, a code or a security key. Two-factor authentication is MFA with exactly two proofs. means a stolen password alone no longer opens the account. Start with email, cloud services, remote access and admin portals. Cyber Essentials requires it for every cloud service (source: UK NCSC, April 2026), and CISA calls FIDO-based sign-in, such as passkeysPasskeyA sign-in method that replaces the password with a cryptographic key kept on your phone or computer and released with a fingerprint, face or PIN. It only works on the genuine website, so a fake login page gets nothing. and security keys, the only widely available form that resists phishing (source: CISA, November 2026).
2. 2
   Critical updates within two weeks, and no unsupported softwareAn update, or patch, closes a known flaw. Turn on automatic updates and give firewalls, routers and VPN gateways, which face the internet directly, their own routine. As of November 2026, Cyber Essentials sets fourteen days for updates that fix flaws with a CVSS scoreCVSS scoreThe Common Vulnerability Scoring System rates how severe a software flaw is on a scale from zero to ten. Seven and above counts as high or critical. of seven or higher, and unsupported software has to go (source: UK NCSC, April 2026).
3. 3
   A backup the attacker cannot reach, and a restore you have testedRansomware, malicious software that encrypts files and demands payment, makes a backup worthless if it can reach it, and the UK NCSC advises assuming that attackers target backups (source: UK NCSC, October 2026). Keep backups offline and separate, ideally offsite (source: UK NCSC, September 2021), test them at least once a year (source: CISA, November 2026), and include cloud data such as email.
4. 4
   Admin rights only for admin workAdmin rights allow installing software and switching off protection, which is why attackers hunt for them. Staff work without them, administrators use a separate account for admin tasks only, never for email or browsing (source: UK NCSC, April 2026), and the accounts of leavers are disabled by their last day (source: CISA, November 2026).

1. 5
   Secure configuration, starting from a complete inventoryRemove unused software and accounts, change default passwords and switch off features that run files automatically (source: UK NCSC, April 2026). That only works for devices you know about: keep a list of devices, network equipment and cloud services, each with an owner, updated at least monthly as CISA's goals ask (source: CISA, November 2026).
2. 6
   Malware protection, ideally with detection and responseAnti-malware should run on every device, with alerts that reach someone who acts on them. EDREDREndpoint detection and response: software on laptops and servers that records behaviour, flags suspicious activity and allows a specialist to isolate a device remotely. It needs someone to watch the alerts. goes further. Cyber Essentials also accepts application allow listing, where only approved, code-signed software may run (source: UK NCSC, April 2026). This measure is already common: 81% of UK businesses have up-to-date malware protection (source: UK government, April 2026).
3. 7
   Phishing awareness, with an easy way to reportPhishing is a fake message that tries to make someone click, sign in or pay. The UK NCSC is clear that no training package teaches people to spot every attempt and that blaming users does not work; make reporting easy instead (source: UK NCSC, February 2024). Add a report button, thank people for early reports, also after a click, and confirm every change of bank details by phone on a known number.
4. 8
   An incident plan, backed by loggingWrite down who decides, whom you call and which systems come back first, print it and rehearse it at least once a year, as CISA's goals ask (source: CISA, November 2026). Only a quarter of UK businesses have a formal plan (source: UK government, April 2026). Logging records who signed in and what changed; the UK NCSC advises keeping key logs for at least six months, protected against tampering, because incidents can take months to detect (source: UK NCSC, May 2021).

The first hours of an attack are covered in ransomware response.

The NIST framework opens with Govern: organisational leadership is responsible and accountable for cybersecurity risk (source: NIST, February 2024). CISA asks for a named role that is responsible for planning, resourcing and carrying out cybersecurity work (source: CISA, November 2026). Yet board-level responsibility for cyber security sat at only 31% of UK businesses (source: UK government, April 2026).

A customer may send a security questionnaire or ask for a certificate; in the UK that may be Cyber Essentials, which 5% of businesses hold (source: UK government, April 2026). Answer an insurer's questions about MFA, backups and updates accurately. In the EU, the NIS2 Directive requires, as a rule, medium-sized and large organisations in 18 critical sectors to manage cyber risk and report significant incidents (source: European Commission, July 2026).

To run security as a programme rather than a checklist, use the NIST framework, starting with Govern. For customers' questions, see security questionnaires; all related guides are in IT and data.