Not overdoing it.
THE PRINCIPLE
Effort proportionate to what is at stake.
WHAT EVERY BUSINESS NEEDS
Updates applied Unique passwords with a second factor Tested backups Basic awareness among staff Access removed when people leave
WHAT SOME NEED IN ADDITION
Encryption of devices Formal access control Monitoring Incident planning Supplier assessment
WHAT ALMOST NOBODY SMALL NEEDS
Elaborate tooling nobody operates Controls so onerous people work around them
THAT LAST POINT
A control people bypass is worse than none, because it creates false confidence.
HOW TO DECIDE
What data you hold What money moves through you What obligations apply What a day of disruption would cost
WHAT TO REVIEW
Whether your controls are actually followed.
Ask the people expected to follow them.
WHAT TO AVOID
Security theatre Spending on products before doing the basics
