Things we'd tell you for free anyway.

Turn on multi-factor authentication for your whole company, this afternoon

If you do one thing from this site, do this. Microsoft reports that MFA blocks over 99% of automated account-takeover attempts. Here is how to turn it on for everyone, in both of the platforms small businesses actually use.

Before you start

• Tell your team it's coming. One short message: "Starting Monday, signing in to email will ask for a code from the authenticator app on your phone. It takes 5 minutes to set up, here's how, ask me if stuck."
• Pick the authenticator app: Microsoft Authenticator or Google Authenticator are both free. Text-message codes are better than nothing but weaker; avoid them where you can.
• Make sure you, the admin, have two ways in before you lock things down: the app on your phone plus printed backup codes in a safe place.

Microsoft 365 (Business Basic, Standard or Premium)

1. Sign in to admin.microsoft.com as a global admin.
2. Go to Microsoft Entra admin center → Properties → Manage security defaults. Set Security defaults to Enabled. This forces MFA registration for everyone within 14 days and blocks old, insecure sign-in methods.
3. If your licence includes Entra ID P1 (Business Premium does), use Conditional Access instead for finer control: one policy, all users, require MFA, exclude a single break-glass admin account that you store offline.
4. Under Users → Active users, open each admin account and confirm MFA shows as registered within the week.

Google Workspace

1. Sign in to admin.google.com as a super admin.
2. Go to Security → Authentication → 2-Step Verification. Tick Allow users to turn on 2-Step Verification, then set Enforcement to On with a start date about a week out, and the enrollment period to 1 day.
3. Under Methods, choose Any except verification codes via text, phone call once everyone has the app.
4. Give yourself a hardware key or backup codes before enforcement day.

The week after

• Check who hasn't enrolled and walk them through it in person. There are always two.
• Turn on MFA for the other accounts that matter: your bank, payroll, domain registrar, website host, and anything with a card on file.
• Write down where the backup codes live. Future you will be grateful.

Want it done for you, with the admin accounts, legacy protocols and break-glass account handled properly? That is the first item in Hardening & Setup.

What your cyber-insurance questionnaire is actually asking

Insurers have figured out which controls predict claims, and their application forms have grown teeth. Answer wrong and you may be denied at renewal. Answer dishonestly and a claim can be refused. Here is what the common questions mean and what "yes" has to look like.

"Do you enforce multi-factor authentication for email, remote access and privileged accounts?"

They mean enforced for everyone, not "available." If one admin or one shared mailbox is exempt, the honest answer is no. This is the question most often tied to a decline.

"Do you maintain offline or immutable backups, and how often are restores tested?"

A backup the attacker can also encrypt doesn't count. They want a copy that ransomware can't reach (cloud with versioning and retention lock, or disconnected media) and a documented test. "We've never had to restore" is the wrong answer; "we restore a sample quarterly and log it" is the right one.

"Do you use endpoint detection and response (EDR)?"

This is antivirus's bigger sibling: it watches behaviour, not just known files. Microsoft Defender for Business, included in Microsoft 365 Business Premium, qualifies for most insurers. Free consumer antivirus usually doesn't.

"Do you have an email filtering solution with protection against phishing and malicious attachments?"

Microsoft 365 and Google Workspace both include this at business tiers. The insurer wants to know it's turned on and that SPF, DKIM and DMARC are published for your domain. Check yours with our spoofing check.

"Do you provide security awareness training and phishing simulations?"

At least annually, with a record of who completed it. A 45-minute session and one simulated campaign a year meets the bar for most small-business policies.

"Do you have a documented incident response plan?"

One page is fine. Who to call, what to unplug, where the backups are, who talks to customers. See the 2 a.m. checklist below for a starting point.

"Are any systems running unsupported software?"

Windows 10 reached end of support in October 2025. If any machine still runs it, say so, or get it replaced before you sign.

How to approach the form

• Answer honestly, then fix the no's. A "no" on the application with a plan is far better than a "yes" that falls apart during a claim investigation.
• Keep evidence: a screenshot of the MFA policy, the backup test log, the training completion list. Insurers increasingly ask for it.
• Reuse the work. The same evidence answers client security questionnaires and most compliance reviews.

We fill these out with clients as part of Compliance & Insurance Readiness, and the Security Baseline report is written to answer them.

The 2 a.m. ransomware checklist

A screen says your files are encrypted and there is a countdown. Your hands are shaking. Do these things in this order. Do not improvise.

1. Disconnect, don't shut down. Unplug the network cable or turn off Wi-Fi on the affected machine. Leave it powered on; the memory may hold evidence and sometimes keys.
2. Isolate the rest. If you can, power off the Wi-Fi router or pull the switch's uplink. Yes, this takes everyone offline. That is the point.
3. Do not pay, and do not contact the attacker yet. Payment is a last resort made with your insurer and a professional, not a decision for 2 a.m.
4. Call, in this order: your IT or security provider; your cyber-insurance carrier's hotline (it is on your policy; put it in your phone now); then, if money moved, your bank.
5. Change the passwords that matter, from a clean device. Email admin, bank, payroll, domain registrar. Assume the attacker read your mailbox. Turn on MFA if it wasn't.
6. Do not restore from backup yet. First confirm the backup is clean and the attacker is out, or you'll restore straight back into the breach.
7. Write down what you know. Time noticed, which machines, what the screen said, what you did. Photos of the screen are fine. The insurer and anyone helping you will ask.
8. Tell your people one clear thing. "We've had a security incident. Don't log in to anything work-related until I say so. I'll update you at 9." Rumours are worse than facts.
9. Check your legal clock. If customer or health data may be involved, breach-notification deadlines start now. Your insurer's hotline will walk you through this.

Before 2 a.m. ever happens

• Put the insurer's hotline and your IT contact in your phone under "SECURITY INCIDENT" so you can find them while panicking.
• Test a restore this quarter. A backup nobody has restored from is a hope, not a plan.
• Keep one laptop that is never used for day-to-day work. It is your clean device for step five.

Every Backup & Recovery project ends with a version of this checklist filled in with your names, numbers and systems, laminated if you like.