Many organisations know that their security needs improvement but struggle with where to begin. Trying to fix everything simultaneously usually creates confusion and little lasting improvement.
A defined first 30 days provides a practical sequence: understand what exists, secure important accounts, address obvious technical weaknesses, improve resilience, and establish a routine for ongoing maintenance.
Week 1 — Visibility and accounts
- Inventory critical systems, applications, websites and remote-access services.
- Identify administrator and privileged accounts.
- Remove unused accounts and shared administrative logins.
- Enable MFA on important administrative and externally accessible services.
- Identify systems or services that are no longer required.
Week 2 — Patching and devices
- Bring operating systems and important applications up to date.
- Review browser and endpoint protection status.
- Check disk encryption on portable systems.
- Identify systems that cannot currently be patched and document the reason.
Week 3 — Backups, email and external exposure
- Review backups of critical systems and data.
- Confirm that at least one backup copy is separated from the main environment.
- Test a representative restore.
- Review email security, including SPF, DKIM and DMARC where appropriate.
- Review services exposed to the internet.
- Remove unnecessary remote-access or management services.
Week 4 — Documentation and routine
- Document the important systems and their owners.
- Record the principal security risks.
- Define practical security policies.
- Establish a patching and account-review routine.
- Decide how incidents will be reported and handled.
After the first 30 days
The objective is not to declare the organisation “secure” after one month. The objective is to move from ad-hoc security activity to a manageable operational routine.
Review accounts, patches, backups, exposed services and significant risks periodically. Improvements that can be maintained are more useful than a large collection of one-off changes.