Cyber threats evolve faster than most businesses update their defenses. This checklist covers the non-negotiable security controls every organization should have in place by 2026 -- regardless of size or industry.
Identity and access
- Multi-factor authentication (MFA) on everything. Not just email. VPN, cloud admin panels, SaaS tools, remote desktop -- if it accepts a password, it needs a second factor. SMS-based MFA is better than nothing, but hardware keys (FIDO2) or authenticator apps are significantly stronger.
- Conditional access policies. Block sign-ins from unexpected geolocations. Require compliant devices for sensitive resources. Most identity providers (Entra ID, Okta, Google Workspace) support this natively.
- Least-privilege access. No one gets admin rights by default. Elevate temporarily when needed, audit quarterly.
Endpoint protection
- EDR on every endpoint. Traditional antivirus misses fileless attacks, living-off-the-land binaries, and zero-days. Endpoint Detection and Response (EDR) tools like CrowdStrike, SentinelOne, or Microsoft Defender for Endpoint provide behavioral analysis and automated containment.
- Patch management SLA. Critical vulnerabilities patched within 72 hours. High within 7 days. Everything else within 30 days. No exceptions for "that one server nobody wants to touch."
- Full-disk encryption. BitLocker on Windows, FileVault on macOS. A stolen laptop should yield zero usable data.
Backup and recovery
- 3-2-1 backup rule. Three copies of data, on two different media types, with one offsite (or in a separate cloud region). Test restores monthly -- backups you have never restored are just assumptions.
- Immutable backups. Ransomware specifically targets backup volumes. Use write-once storage or air-gapped copies that cannot be encrypted by an attacker who compromises your network.
- Documented recovery time objectives (RTO). Know how long each critical system takes to restore. If the answer is "we have never timed it," that is your weekend project.
Employee training
- Quarterly phishing simulations. Track click rates over time. Celebrate improvement, do not punish failure -- shame creates underreporting.
- Security onboarding for new hires. Cover password hygiene, social engineering red flags, and how to report suspicious activity before they get their first laptop.
- Incident reporting culture. Employees should feel safe saying "I clicked something weird" within minutes, not hide it for days hoping nothing happens.
Incident response
- Written incident response plan. Who gets called at 2 AM? Who has authority to isolate systems? Where are the runbooks? If the answer to any of these is "it depends," the plan is incomplete.
- Tabletop exercises. Run a simulated breach scenario twice a year. Walk through the response steps, identify gaps, update the plan.
- Retainer with a forensics firm. When a real incident hits, you do not want to be shopping for help. Pre-negotiated retainers mean faster response when minutes matter.
Next steps
Print this list, walk through it with your team, and mark what is missing. Even implementing two or three items from this checklist meaningfully reduces your attack surface. Perfect security does not exist, but prepared organizations recover faster and lose less.