Buyer guide · SME baseline
A small set of operated controls beats a large unused checklist.
Use this baseline to identify the first practical improvements for a growing organisation.
| Priority | Action | Evidence it works |
|---|---|---|
| 1 | Require phishing-resistant MFA where supported; protect administrator and finance accounts | Quarterly access review and recovery test |
| 2 | Maintain an owned inventory of public systems, cloud accounts and critical SaaS | Named owner and last-reviewed date |
| 3 | Patch critical internet-facing and endpoint vulnerabilities on an agreed timeline | Coverage and exception record |
| 4 | Keep isolated backups and test restoration of one critical process | Dated restore evidence |
| 5 | Deploy managed endpoint protection and centralise essential alerts | Alert test and escalation record |
| 6 | Create a one-page incident contact and containment plan | Tabletop exercise result |
| 7 | Review critical suppliers and remove unused integrations | Supplier register and offboarding record |
| 8 | Train payment, helpdesk and executive teams on realistic fraud paths | Scenario-based decision results |
Turn the next security decision into a clear scope.
Tell us what you need to protect, prove or improve. We will define the evidence, boundaries and next action before work begins.