Work through the list honestly. A control that exists on paper but has never been tested should be marked as a gap.
- Backups you have restored from. Keep at least three copies on two kinds of storage with one offline or immutable. Then restore from them on a schedule. An untested backup is the most common reason companies end up paying.
- Multi-factor authentication everywhere it matters. Email, VPN, remote access, admin consoles and backup systems first. Stolen passwords are still the easiest way in.
- A password manager for the whole team. Unique credentials per system, shared through vaults instead of spreadsheets and chat, with access removed the day someone leaves.
- Patching with a deadline. Internet-facing systems and remote access tools within days of a critical fix, everything else on a fixed monthly cycle. Track what is overdue.
- Managed endpoint protection. Modern endpoint detection and response on every device, with someone actually watching the alerts.
- Least privilege. Nobody works day to day as an administrator. Admin accounts are separate, few, and reviewed quarterly.
- Email filtering and user awareness. Filter phishing and malicious attachments before they reach people, and make it easy and blame-free to report a suspicious message.
- Segmentation and an incident plan. Separate critical systems so one infected laptop cannot reach everything. Write down who decides what in the first hour of an incident, and keep a printed copy.
How to use this list
Score each item as done, partial or missing. Fix backups and multi-factor authentication first, since they change the outcome of an attack the most. Then set a date for the rest. Revisit the list twice a year and after any significant change to your systems.
As a Sophos and 1Password partner, we help teams close these gaps and manage the controls day to day. A security review is a good place to start.