How to improve your cyber security in 90 days

Days 1-30: stop the common attacks

• Enforce MFA everywhere and block legacy authentication
• Inventory every device, user and cloud service; you cannot protect an unknown estate
• Remove local administrator rights from standard users
• Patch critical vulnerabilities within 14 days and prove it with a report
• Confirm backups exist, are offline or immutable, and restore one file successfully

Days 31-60: see what is happening

• Deploy endpoint detection and response with someone watching the alerts
• Turn on audit logging in Microsoft 365 and alert on risky sign-ins and mailbox rules
• Publish DMARC and move towards enforcement
• Review firewall rules and close anything exposed that should not be

Days 61-90: prove and rehearse

• Run a phishing simulation and measure reporting speed
• Write a one-page incident response plan with names and phone numbers
• Rehearse a restore of a critical system end to end
• Begin Cyber Essentials, which validates the work you have just done

What to do continuously

• Monthly patch and vulnerability reporting
• Joiner-mover-leaver access reviews
• Quarterly firewall and privileged access review
• Annual restore test and plan rehearsal
• Continuous dark web exposure monitoring

How to measure progress

• Percentage of accounts with enforced MFA
• Median time to patch a critical vulnerability
• Median time to report a simulated phish
• Time to remove a leaver's access
• Last successful restore test date

When to bring in help

If nobody owns security as a named responsibility, or if alerts arrive outside working hours with no one to act, a managed service or SOC is cheaper than an unmonitored tool set.