The short list.
UPDATES
Automatic, everywhere. This prevents more than anything else.
PASSWORDS
Unique for every account, through a password manager. Reuse is the biggest single risk.
SECOND STEP
Everywhere it is offered. Email first.
CODES
Never give a verification code to anyone, whoever they claim to be.
LINKS
Never log in through a link in a message about an account. Go to the site directly.
MONEY
No payment detail change without a voice call to a number you already had. No exceptions for urgency or seniority.
BACKUPS
Separated, and tested. At least one copy a compromised machine cannot reach.
DEVICES
Screen lock and encryption. A lost device is then an inconvenience, not a breach.
ACCESS
Individual accounts, minimum permissions, removed the day someone leaves.
REPORTING
Immediately, with no blame. Minutes matter.
WHAT TO DO IF YOU REMEMBER NOTHING ELSE
Updates, unique passwords, a second step, and a tested backup.
