Protection is a plan you can explain, not a product you bought.

How much of the baseline do you already have?

Twelve yes-or-no questions: the ones an insurer’s form asks, and the ones a breach actually turns on. Tick what is true today, not what is planned. Nothing you tick leaves this page.

• MFA on email

  Enforce two-step verification for everyone in Google Workspace or Microsoft 365, with an authenticator app or a hardware key rather than a text message, and turn on the setting that stops people disabling it. Email is the account that resets every other password.

• MFA on banking and payroll

  Turn on the bank’s app or hardware-token approval, not text messages, for every user who can pay or transfer. Do the same for payroll and the card processor. Then set a limit above which any transfer needs a second person.

• A password manager

  Set up Bitwarden or 1Password Business in the company’s name: one account per person, shared vaults for the few logins a team genuinely shares. Move the spreadsheet in, then delete it. An afternoon for most businesses.

• A written list of who has access to what

  One sheet: the system, who has an account, what they can do, when it was last checked. Walk it every quarter and remove what nobody needs. It is the first thing the assessment produces, if you would rather we started it.

• Admin rights kept separate

  Give each admin a second account used only for admin work, with MFA, and take admin rights off the everyday accounts. Keep one break-glass owner login in the password manager, sealed, with a note on who may open it.

• An offboarding checklist

  Write the list from the access sheet: email, single sign-on, the CRM, the bank, shared vaults, the door code, their laptop and phone. Name the person who runs it and the person who checks it. With single sign-on in place it takes minutes.

• SPF, DKIM and DMARC

  Add the SPF and DKIM records your mail provider gives you, then a DMARC record at p=none with a reporting address. Read the reports for a couple of weeks, move to p=quarantine, then to p=reject. Without it, anyone can send mail as you.

• A backup restored in the last 90 days

  Pick the system you could least afford to lose, restore last week’s copy to a spare folder or a test account, open a handful of files, and write down the date and what you found. Put the next one on the calendar. A backup nobody has restored is a hope.

• Encrypted, locked, wipeable devices

  Turn on FileVault on Macs and BitLocker on Windows, a screen lock after a few minutes, and enrol every device in Intune or Google endpoint management so a lost laptop can be wiped from a browser. Personal phones with company email count.

• Automatic security updates

  Switch on automatic updates everywhere and check once a month that they happened. Replace anything the maker has stopped updating: an old router or an operating system out of support is an open door. The website and its plugins count too.

• Phishing training in the last year

  A 45-minute session with real examples from your own inbox, then an occasional test email that teaches instead of shames. Above all, make reporting a click a normal thing to do. The damage comes from the hours nobody said anything.

• A one-page incident plan

  One page: the people to call (us, the bank, the insurer, a lawyer) with their numbers, the first three things to do, and where the backups and the password-manager recovery kit are kept. Print it. Read it once a year, and whenever anyone on it changes.

Book the 30 minutes. Worst case, you leave with a plan you can hand to someone else.

No deck. No pitch. You talk about what your week actually looks like and we write down what we would fix first.

The answering desk never closes. Nights, weekends, holidays, storm weeks.