The six layers, must-haves only
Check what you already have. The gaps are your roadmap.
1. Identity (who can get in)
- One managed identity platform (Microsoft 365 or Google Workspace), not a pile of standalone logins.
- MFA everywhere it can be turned on.
- Same-day joiner/leaver process.
2. Devices (what they work on)
- Managed endpoints you can lock, locate, wipe.
- Modern endpoint protection (EDR), not yesterday's antivirus.
- Automatic patching and disk encryption on.
3. Network (what connects them)
- A business-grade firewall, not the ISP's freebie router.
- Guest Wi-Fi separated from business Wi-Fi.
- Remote access through VPN or better, with MFA. No naked remote desktop on the internet.
4. Data and backup (what you can't lose)
- The 3-2-1 rule: three copies, two media, one offsite or immutable.
- Backup for Microsoft 365 / Google data. The platform keeps the lights on; backups are your job.
- A restore test on the calendar, quarterly.
5. Security operations (who's watching)
- Someone monitors alerts, and that someone is awake at 3 a.m. A partner SOC counts; an unread inbox doesn't.
- Email filtering plus SPF/DKIM/DMARC on your domain.
- Security awareness training with phishing practice, at least annually.
6. Collaboration (how work moves)
- Business-tier email and file storage with permissions, not one shared drive where everyone sees everything.
- A shared password manager for the team.
The PDF adds:
- Nice-to-haves, and when your size makes them must-haves
- The retirement flags: Windows 10, Server 2012/2016, the ISP router, the PC nobody dares reboot
- Layer scoring: which two quarters to plan first