Start with MFA on email and admin accounts, then unique passwords in a password manager, automatic updates, tested backups, and a list of who has access to what. These controls take little money and cover the most common attacks. Add the rest as time allows.
Why a ranking helps
Security advice for small groups often arrives as a long list of equal items. With a few volunteer hours, you need an order. A useful ranking balances effort against impact and favors controls that fail safe.
CIS calls its Implementation Group 1 "essential cyber hygiene," the foundational safeguards that every enterprise should apply against the most common attacks. The ranking below follows that spirit, but it is our own prioritization, not a CIS list.
The ranked list
| Rank | Control | Effort | Why it ranks here |
|---|---|---|---|
| 1 | MFA on email and admin accounts | Low | Email resets every other account |
| 2 | Unique passwords in a password manager | Low to medium | Stops password reuse after breaches |
| 3 | Automatic updates on devices and apps | Low | Closes known holes quickly |
| 4 | Backups, with one restore test | Medium | Lets you recover from loss or ransomware |
| 5 | A list of accounts, owners and admins | Low | You cannot protect what you cannot see |
| 6 | Named accounts, no shared logins | Medium | Gives accountability and clean removal |
| 7 | Remove access at departures | Low, ongoing | Prevents old access from lingering |
| 8 | One page incident plan | Low | Cuts confusion on a bad day |
| 9 | Phishing awareness habit | Low, ongoing | Reduces the most common entry route |
| 10 | Review of vendors that hold your data | Medium | Funders and donors rely on them |
How to use it
- Mark each control as done, partly done or not started.
- Pick the highest ranked item that is not done.
- Give it an owner and a date.
- Review monthly for fifteen minutes.
Do not aim to finish all ten in one month. One control done and checked is worth more than ten started.
Details for the first four
MFA. Prefer app based or hardware methods over text messages where you can. Our guide on MFA for small organizations compares them.
Passwords. CISA suggests passwords of at least 16 characters that are random and unique, with a password manager to hold them.
Updates. CISA advises installing updates promptly and turning on automatic updates.
Backups. A backup you have never restored is a hope. Try one restore of one file or one database and write down how long it took. See backup restore tests for small teams.
What to skip for now
Tools you cannot staff are a trap. A complex monitoring product with nobody reading alerts adds noise, not safety. Choose controls a part time person can maintain.
Quick check
Is this a compliance standard?
No. It is a practical ordering. If a funder asks about a framework, answer honestly about which parts you follow.
What if we already have an IT volunteer?
Share the list, agree an order and make sure the knowledge is written down so it does not leave with them.
Sources
Last reviewed: 19 October 2026.
