A small team should start with five areas: strong access control, no exposed remote services, tested offline backups, centralised logs, and a written plan. These come straight from CISA's #StopRansomware guide and the NCSC's mitigation guidance. Work through them in order and record the evidence.
1. Access
- Phishing-resistant MFA for all services, starting with administrators and remote access (CISA).
- Unique passwords of at least 15 characters (CISA).
- Separate administrator accounts from daily accounts, with least privilege (CISA).
- No privileged accounts for email and web browsing (NCSC).
2. Exposure
- Do not expose services such as remote desktop on the web (CISA).
- Patch internet-facing and remote access systems promptly, especially firewalls and VPN products (NCSC).
- Scan for vulnerabilities (CISA).
- Disable SMBv1 and move to SMBv3, and limit SMB use (CISA).
3. Backups
- Offline, encrypted backups of critical data (CISA).
- Copies kept separate, in a different location, ideally offsite (NCSC).
- Restore tests on a schedule you keep (CISA, NCSC).
- Golden images and infrastructure as code for fast rebuilds (CISA).
4. Detection and logging
- Centralised logs kept at least a year where possible (CISA).
- Alerts for new privileged accounts, backup tampering and odd VPN logins.
- Application allowlisting and EDR where you can run them (CISA).
5. Email and endpoints
- DMARC, attachment filtering, and macros disabled for email-delivered Office files (CISA).
- Restrict PowerShell use (CISA).
6. Third parties
- Least privilege for vendors and managed service providers, with logged and removable access (CISA).
7. Planning
- A written incident response plan, kept offline, with contacts (CISA, NCSC).
- A critical asset list with dependencies.
- A first hour checklist and an exercise at least once a year, or as often as you can keep up.
- Reporting contacts for law enforcement and regulators.
How to prioritise
If you have a month, take items from sections 1, 2 and 3 first. Backups and exposed remote access are the areas where the guidance is most consistent. The rest builds on them.
Where tooling helps
Asset discovery and dependency scanning feed the exposure and patching items. Safeguard provides both, with reachability analysis to separate exploitable vulnerabilities from noise, and a free scan at https://gold.safeguard.sh/scan. It does not replace backups, access controls or a response plan.
Quick check
What is the single most important item?
Neither source ranks them. A tested offline backup is the one control that lets you recover without negotiating, so many teams start there.
Do we need EDR to be ready?
CISA lists EDR as one of several measures. It is useful for detection, but a small team can make real progress with access, exposure and backups first.
Sources
Last reviewed: 19 October 2026.
