A short list of actions that give the most protection in the next three months. Focus on the steps that block the most common attack paths and speed up recovery.
What this means in practice
A useful test is to ask who would act on this tomorrow morning and what they would need. If the answer is unclear, the gap is organisational rather than technical, and that is usually the cheaper one to close.
Key actions
- MFA on all remote access and admin accounts
- Immutable backups with a tested restore
- EDR with 24/7 alert handling
Next steps
Review progress monthly and report it to management. Keep the first version short. A one-page routine that people follow beats a long document nobody reads.