Checklists have an obvious failing: they encourage treating security as a set of items to tick rather than a property of a system. Used carefully, though, an ordered list is useful — because the order is the advice.

What follows is roughly the sequence we would work through with a UK SME that is starting from an unknown position. Each item includes what it actually protects against, because a control you do not understand is one you will eventually disable for convenience.

Identity — where most incidents begin

1. Multi-factor authentication on every account

The single highest-value control available to an SME. It defeats the overwhelming majority of credential-based attacks, which is how most incidents against smaller organisations begin.

Check the exclusions. This is the part that fails. MFA “enabled” usually means enabled for most people, with a group of exceptions created for a migration or a legacy system, still populated with active users years later.

2. Reduce administrator accounts

Count your Global Administrators. If there are more than two or three in an organisation of a hundred people, that is a finding. Each one is an account whose compromise gives complete control of your email, files and identity.

Move to named accounts with elevation when required rather than permanent rights.

3. Block legacy authentication

Older protocols cannot enforce MFA, so they are a documented bypass. Blocking them is straightforward; the work is identifying the one elderly device or application still using them.

4. A leaver process that is actually followed

Not just licence removal. Group memberships, application access, shared mailbox permissions, mobile devices, third-party accounts. Write it down, assign it an owner, and audit it twice a year.

5. Review guest and external accounts

Guests accumulate. Someone from a supplier added for a 2022 project frequently still holds access to a Teams site containing everything shared since.

Email — the most common entry point

6. SPF, DKIM and DMARC

These stop other people sending email that appears to come from your domain. Notably, they protect your customers and suppliers from being defrauded in your name — which is a commercial and reputational exposure as much as a technical one.

Move DMARC to enforcement rather than leaving it in monitoring mode indefinitely.

7. Anti-impersonation protection

Configure protection for your senior staff specifically. The common attack is not sophisticated: an email that looks like it is from the managing director, asking finance to change a supplier’s bank details.

8. External sender marking

A visual indicator on messages from outside the organisation. Simple, and it prevents a category of mistake.

9. Monitor mailbox rules

Attackers who gain mailbox access frequently create a rule to hide their activity — auto-deleting replies, or forwarding externally. Alert on rule creation, particularly forwarding rules.

Devices

10. Patch operating systems and browsers

Unglamorous and consistently effective. Automate it, and confirm the automation is actually working — a patch policy that has been failing silently for four months is not unusual.

11. Patch third-party software

The browser and the operating system usually get attention. PDF readers, Java, remote access tools and line-of-business applications often do not.

12. Remove local administrator rights

Users who cannot install software cannot be tricked into installing malware. This is more disruptive than it sounds and worth doing anyway, with a proper exception process.

13. Disk encryption

BitLocker or FileVault, enabled and with recovery keys stored somewhere you can actually retrieve them. It protects against the mundane and common event: a laptop left on a train.

14. Endpoint detection configured to respond

Most organisations have something installed. Considerably fewer have it configured to act, alerting to somewhere a person looks. Software in monitor-only mode with nobody reading the alerts provides documentation of your breach rather than prevention of it.

Data and access

Anonymous “anyone with the link” sharing does not expire by default. Audit what exists, expire the old, and set an expiry policy going forward.

16. Review permissions on shared storage

Broken inheritance, sites with no owner, and folders where “everyone” was granted access for a project years ago. This matters increasingly, because AI assistants surface exactly what these permissions allow.

By default, users may be able to grant a third-party application permission to read their mail or files. Restrict this so consent requires administrative approval.

Backup and recovery

18. Backups that a compromise cannot destroy

If your backups can be reached and deleted using credentials that exist on your network, they will not survive a ransomware incident. Deleting backups first is standard practice for attackers, not bad luck. Immutable or credential-isolated storage.

19. Back up Microsoft 365

Microsoft protects the platform and provides retention features. That is not the same as a backup you control. Whether the gap matters depends on your obligations — but you should make that decision deliberately rather than by assumption.

20. Test a restore

Actually restore something, into an isolated environment, and time it. The first test almost always reveals a missing component. A backup that has never been restored is a hypothesis.

What is deliberately not on this list

Products. Almost everything above is configuration of something you already own, most of it available in Microsoft 365 Business Premium.

Cyber Essentials certification. Worth having, particularly if you tender for public sector work, and it covers much of the ground above. But certification is evidence of controls, not a substitute for them, and we would rather you had the controls first.

Penetration testing. Valuable when your fundamentals are in order. Commissioning one before you have MFA everywhere produces an expensive report telling you to enable MFA.

Security awareness training. Useful, and frequently oversold as a primary control. Train people, certainly — but design systems so that a single human error is survivable, because eventually there will be one.

How to use this

Work down it in order. Items 1 to 5 remove more risk than everything below them combined, and can typically be completed in a fortnight.

If you get to the bottom and can honestly tick everything, you are in better shape than most organisations of your size — and the next useful step is an independent review, because the things that are wrong are the things you already believe are right.