A practical five point cybersecurity checklist is: know what you own, require multifactor authentication, patch vulnerabilities that attackers are actually using, keep offline backups you have restored in a test, and rehearse your incident response. Each point maps to guidance from CISA, and each can be checked in an afternoon.
Why only five?
Frameworks run to hundreds of controls. CISA built its Cross-Sector Cybersecurity Performance Goals as a subset chosen to help small and medium organizations start by prioritizing a limited number of high-impact actions. A short list gets done. A long list gets filed. Treat these five as a starting floor, then grow toward a full framework such as NIST CSF 2.0.
1. Do you know what you own?
You cannot patch, back up or monitor what is not on a list. Start with three lists: devices, cloud accounts and business applications, and the software components inside the applications you build.
Check: pick one cloud account at random and ask who owns it. If no one can answer in a minute, the inventory is not ready.
2. Is multifactor authentication on?
CISA's guidance on ransomware and on phishing both include enforcing MFA, and the ransomware guide goes further, describing phishing-resistant MFA and passwordless options that use factors such as a device PIN, a biometric or a cryptographic key. It also says to escalate to senior management when systems cannot use MFA or do not enforce it, and when users are not enrolled.
Check: list every internet-facing login. For each one, is MFA required for everyone, including administrators and service accounts that sign in interactively?
3. Are you patching what attackers actually use?
Not every vulnerability is equal. CISA keeps a Known Exploited Vulnerabilities catalog that lists vulnerabilities with evidence of exploitation. It is a good way to rank a long patch backlog: anything in your estate that appears in the catalog goes to the front of the queue.
Check: export your software inventory and compare it to the catalog by product. Count matches. Each is an item with a deadline.
4. Can you restore from backup?
CISA says to maintain offline, encrypted backups of critical data and to test their availability and integrity in a disaster recovery scenario, because many ransomware variants search for backups and delete or encrypt any that they can reach.
Check: time a restore of one important system. Write down how long it took and what you did not have on hand, such as a license key, a password or documentation.
5. Have you rehearsed the response?
The CISA K-12 report lists developing and exercising a cyber incident response plan among its most impactful measures, alongside MFA, patching, backups, minimizing exposure to common attacks and training. A plan only works if people have read it.
Check: run a one-hour tabletop. Ask who decides to take a system offline, who calls the insurer or counsel, and how you will communicate if email is down. CISA's guidance recommends out-of-band communication, such as phone calls, in case attackers are watching internal channels.
How to score yourself
Give each point one of three marks: done and tested, done but untested, or not done. Untested counts as not done for planning purposes, because many failures happen at the moment of use.
A constructed example: a 60-person company marks inventory as untested (a spreadsheet nobody has checked), MFA as done (confirmed in the identity admin console), patching as not done, backups as untested, and response as not done. That is a clear plan: test the inventory and backups, then write patching and response procedures.
How to check or apply this
- Build the three inventories and name an owner for each.
- Turn on MFA for every internet-facing login, administrators first.
- Compare your software to the Known Exploited Vulnerabilities catalog and patch matches.
- Run a timed restore of one critical system and record the result.
- Hold a one-hour tabletop and fix whatever slowed you down.
- Repeat each quarter and move on to the full performance goals.
Quick check
Is a five point checklist enough to be secure?
No. It is a floor. It addresses common, avoidable causes of compromise, but regulated or high-risk organizations need a full framework and independent assurance.
Which point should come first?
Start with the inventory, since the other four depend on knowing what you have. If you must pick one quick win, enable MFA on internet-facing logins.
Sources
- CISA Cross-Sector Cybersecurity Performance Goals
- CISA #StopRansomware Guide
- CISA, Avoiding Social Engineering and Phishing Attacks
- CISA Known Exploited Vulnerabilities Catalog
- CISA K-12 report, Protecting Our Future
Last reviewed: 18 October 2026.
