Security frameworks are comprehensive and, for a small business, frequently paralysing. What follows is a practical ordering based on what reduces the most risk per hour invested, drawn from the incidents we actually see rather than from a control catalogue.

Month 1 — the highest-value fundamentals

  • Phishing-resistant MFA on email, identity provider, and every administrative console.
  • Perform one full restore from backup and time it.
  • Remove any management interface exposed directly to the internet.
  • Inventory who has administrative access anywhere, and remove what is not needed.

Month 2-3 — accounts and email

  • Deploy a password manager and migrate everyone's credentials properly.
  • Configure SPF, DKIM, and DMARC, moving to enforcement after monitoring.
  • Turn on alerts for new mailbox forwarding rules.
  • Write and adopt the payment-verification rule: detail changes verified by callback.

Month 4-6 — visibility and resilience

  • Enable audit logging with extended retention on your main platforms.
  • Set up four or five high-signal alerts and route them somewhere people read.
  • Ensure one backup copy is offline, immutable, or in a separate account.
  • Write the incident response one-pager: who decides, who to call, what to preserve.

Month 7-9 — reducing exposure

  • Audit cloud storage sharing and remove public links and stale external access.
  • Review third-party application authorisations and revoke what is unused.
  • Establish a patching schedule for internet-facing systems and stick to it.
  • Document and test the offboarding checklist.

Month 10-12 — maturity

  • Run a tabletop exercise on a realistic scenario and fix what it exposes.
  • Review vendor access and data holdings; remove what is no longer needed.
  • Draft incident communication templates and have them reviewed.
  • Reassess: what changed, what is now the largest remaining risk?

Keep a record as you go

Note what you implemented and when. This becomes your answer to client security questionnaires, your evidence for insurers — where inaccurate warranties can void coverage — and your starting point next year. It takes minutes per item and saves days later.

What this deliberately omits

Advanced tooling, formal certification, and dedicated staff. Those become relevant at a certain scale or when a contract requires them. Reaching the end of this list puts a small business ahead of the majority of organisations of its size, and addresses the mechanisms behind most incidents we are called to investigate.