If you run a small business

In order, the way the first ones help the later ones. Tick a step when it is done and your profile updates: the line below shows it as you go, and the full profile is beside the steps on a wide screen and after them on a phone. Your ticks stay in this browser; nothing is sent anywhere.

0 of 9 ticked · Identity: Traditional · Devices: Traditional · Applications and Workloads: Traditional · Data: Traditional · Visibility and Analytics: Traditional

1. Step 1: List what you have

   Write down every device, system and software account that touches company data, and who uses each one. Keep the list current as people and tools come and go.

   CPG 2.0 goal 2.A · Manage organizational assets (CISA, page 15)

   Cost

   Low

   Less than 5% of the organisation’s annual security budget.

   Impact

   High

   Prevents severe or catastrophic harm: the organisation could not carry out its mission.

   Ease

   Moderate

   Takes about 4 to 8 months and moderate technical expertise or management involvement.

   CISA says these ratings apply mainly to IT infrastructure, not to operational technology or other non-IT systems.

   Moves Devices · Asset & Supply Chain Risk Management: Traditional → Initial

   Matches CISA’s cell in part. CISA’s Initial cell also asks for supply chain risk to be managed through policies and baselines; a list of what you have is the first half.

   What CISA’s Initial cell says

   All physical assets and some virtual ones are tracked, and supply chain risk is managed through policies and control baselines drawn from federal recommendations. (Zero Trust Maturity Model, Table 3, page 17; paraphrased, and CISA’s wording says “agency”.)

   Sources for this step

   • CISA Cross-Sector Cybersecurity Performance Goals 2.0: Goal 2.A, page 15: Manage organizational assets
   • CISA Zero Trust Maturity Model: Table 3, page 17: Asset & Supply Chain Risk Management, Initial
2. Step 2: Turn on MFA everywhere

   Turn on multi-factor sign-in for every account that offers it, starting with administrators and email. Where a service supports passkeys or hardware security keys, use those: they are the only widely available kind that a fake sign-in page cannot relay. Where it does not, use an authenticator app, ideally with number matching, and keep text-message codes as the last resort.

   Why passkeys and security keys: the phishing-resistant MFA tutorial →

   CPG 2.0 goal 3.F · Implement multifactor authentication (MFA) (CISA, page 20)

   Cost

   Moderate

   Between 5% and 15% of the annual security budget.

   Impact

   High

   Prevents severe or catastrophic harm: the organisation could not carry out its mission.

   Ease

   Moderate

   Takes about 4 to 8 months and moderate technical expertise or management involvement.

   CISA says these ratings apply mainly to IT infrastructure, not to operational technology or other non-IT systems.

   Moves Identity · Authentication: Traditional → Initial, and starts toward Advanced

   Matches CISA’s cell in part. CISA’s Traditional cell already allows MFA; its Initial cell adds checking more than one attribute (such as location or activity), and its Advanced cell is phishing-resistant MFA, which this step reaches only where a service supports it.

   What CISA’s Initial cell says

   Identity is checked with multi-factor authentication (a password may be one factor), and more than one attribute of the person or thing, such as where they are or what they are doing, is validated. (Zero Trust Maturity Model, Table 2, page 13; paraphrased, and CISA’s wording says “agency”.)

   Sources for this step

   • CISA Cross-Sector Cybersecurity Performance Goals 2.0: Goal 3.F, page 20: Implement multifactor authentication (MFA)
   • CISA, Cyber Guidance for Small Businesses: The IT lead’s tasks: mandate MFA with technical controls, administrators first; the CEO’s note that the only widely available phishing-resistant sign-in is FIDO
   • CISA, Implementing Phishing-Resistant MFA: Table 1, page 2: forms of MFA from strongest to weakest; app codes or push with number matching as the best option for small and medium businesses that cannot yet use phishing-resistant MFA; SMS only as a last resort
   • CISA Zero Trust Maturity Model: Table 2, page 13: Authentication, Initial
3. Step 3: Separate admin accounts

   Give anyone who administers systems a separate account for that work, and take administrator rights off everyday laptops, so that one bad download cannot install itself.

   CPG 2.0 goal 3.G · Administrators maintain separate user and privileged accounts (CISA, page 21)

   Cost

   Low

   Less than 5% of the organisation’s annual security budget.

   Impact

   High

   Prevents severe or catastrophic harm: the organisation could not carry out its mission.

   Ease

   Simple

   Done within a few months with little technical expertise.

   CISA says these ratings apply mainly to IT infrastructure, not to operational technology or other non-IT systems.

   Moves Identity · Access Management: Traditional → Initial

   Matches CISA’s cell in part. CISA’s Initial cell is access that expires and is reviewed automatically; taking everyday accounts off administrator rights is the first move away from permanent privileged access.

   What CISA’s Initial cell says

   Access, including privileged-access requests, that expires and is reviewed automatically. (Zero Trust Maturity Model, Table 2, page 14; paraphrased, and CISA’s wording says “agency”.)

   Sources for this step

   • CISA Cross-Sector Cybersecurity Performance Goals 2.0: Goal 3.G, page 21: Administrators maintain separate user and privileged accounts
   • CISA, Cyber Guidance for Small Businesses: The IT lead’s tasks: remove administrator privileges from user laptops
   • CISA Zero Trust Maturity Model: Table 2, page 14: Access Management, Initial
4. Step 4: One sign-in, and a clean exit

   Use one identity provider so people sign in once to the business apps, and keep a set routine for switching a person off everywhere when they leave.

   CPG 2.0 goal 3.D · Revoke credentials for departing staff (CISA, page 19)

   Cost

   Low

   Less than 5% of the organisation’s annual security budget.

   Impact

   High

   Prevents severe or catastrophic harm: the organisation could not carry out its mission.

   Ease

   Moderate

   Takes about 4 to 8 months and moderate technical expertise or management involvement.

   CISA’s goal 3.D is the leaving routine. Single sign-on comes from the maturity model’s cell, which names it.

   CISA says these ratings apply mainly to IT infrastructure, not to operational technology or other non-IT systems.

   Moves Identity · Identity Stores: Traditional → Initial

   Matches CISA’s cell in part. CISA’s Initial cell is a mix of stores with minimal integration, with single sign-on as its example; one provider for every business app is nearer its Advanced cell, which begins to consolidate stores.

   What CISA’s Initial cell says

   A mix of self-managed and hosted (cloud or other) identity stores with minimal integration between them; the cell gives single sign-on as its example. (Zero Trust Maturity Model, Table 2, page 14; paraphrased, and CISA’s wording says “agency”.)

   Sources for this step

   • CISA Cross-Sector Cybersecurity Performance Goals 2.0: Goal 3.D, page 19: Revoke credentials for departing staff
   • CISA Zero Trust Maturity Model: Table 2, page 14: Identity Stores, Initial
5. Step 5: Manage laptops and phones

   Switch on automatic updates and disk encryption for every laptop and phone, keep them managed so you can see their state, and let only managed devices reach the sensitive apps.

   CPG 2.0 goal 2.B · Mitigate known vulnerabilities (CISA, page 15)

   Cost

   High

   More than 15% of the annual security budget.

   Impact

   High

   Prevents severe or catastrophic harm: the organisation could not carry out its mission.

   Ease

   Complex

   Takes closer to a year or more and needs significant expertise, coordination and management involvement.

   CPG 2.0 goal 3.R · Prohibit connection of unauthorized devices (CISA, page 26)

   Cost

   Moderate

   Between 5% and 15% of the annual security budget.

   Impact

   High

   Prevents severe or catastrophic harm: the organisation could not carry out its mission.

   Ease

   Complex

   Takes closer to a year or more and needs significant expertise, coordination and management involvement.

   CISA’s goal 3.R is about keeping unauthorised media and hardware, such as USB drives, off your systems. Letting only managed devices reach sensitive apps is this site’s reading, from the maturity model’s Resource Access row.

   CISA says these ratings apply mainly to IT infrastructure, not to operational technology or other non-IT systems.

   Moves Devices · Policy Enforcement & Compliance Monitoring: Traditional → Initial

   Matches CISA’s cell closely.

   What CISA’s Initial cell says

   Devices report their own characteristics, with limited enforcement; a basic process approves software and pushes updates and configuration changes to devices. (Zero Trust Maturity Model, Table 3, page 17; paraphrased, and CISA’s wording says “agency”.)

   Moves Devices · Resource Access: Traditional → Initial

   Matches CISA’s cell closely.

   What CISA’s Initial cell says

   Some devices are required to report their characteristics, and that information is used to approve access to resources. (Zero Trust Maturity Model, Table 3, page 17; paraphrased, and CISA’s wording says “agency”.)

   Sources for this step

   • CISA Cross-Sector Cybersecurity Performance Goals 2.0: Goal 2.B, page 15: Mitigate known vulnerabilities
   • CISA Cross-Sector Cybersecurity Performance Goals 2.0: Goal 3.R, page 26: Prohibit connection of unauthorized devices
   • CISA, Cyber Guidance for Small Businesses: The IT lead’s tasks: patch and prioritise the Known Exploited Vulnerabilities catalogue, turn on auto-update, enable disk encryption on laptops
   • CISA Zero Trust Maturity Model: Table 3, page 17: Policy Enforcement & Compliance Monitoring, Initial
   • CISA Zero Trust Maturity Model: Table 3, page 17: Resource Access, Initial
6. Step 6: Give people only what they need

   Give each person only the access their job needs, and review who can reach what every quarter, taking away what is no longer needed.

   CPG 2.0 goal 3.H · Implement the principles of least privilege (CISA, page 21)

   Cost

   Low

   Less than 5% of the organisation’s annual security budget.

   Impact

   High

   Prevents severe or catastrophic harm: the organisation could not carry out its mission.

   Ease

   Simple

   Done within a few months with little technical expertise.

   CISA says these ratings apply mainly to IT infrastructure, not to operational technology or other non-IT systems.

   Moves Identity · Access Management: Traditional → Initial, and starts toward Advanced

   Matches CISA’s cell in part. Giving each person only what the job needs points at CISA’s Advanced cell (need-based access), but that cell is also session-based, and a quarterly review is not automated.

   What CISA’s Initial cell says

   Access, including privileged-access requests, that expires and is reviewed automatically. (Zero Trust Maturity Model, Table 2, page 14; paraphrased, and CISA’s wording says “agency”.)

   Sources for this step

   • CISA Cross-Sector Cybersecurity Performance Goals 2.0: Goal 3.H, page 21: Implement the principles of least privilege
   • CISA Zero Trust Maturity Model: Table 2, page 14: Access Management, Initial
7. Step 7: Keep logs, and look at them

   Keep the logs of sign-ins and administrator actions somewhere an attacker cannot edit them, and have a named person who looks at them.

   CPG 2.0 goal 3.Q · Maintain log collection and storage (CISA, page 26)

   Cost

   Moderate

   Between 5% and 15% of the annual security budget.

   Impact

   High

   Prevents severe or catastrophic harm: the organisation could not carry out its mission.

   Ease

   Moderate

   Takes about 4 to 8 months and moderate technical expertise or management involvement.

   CISA’s small-business page does not mention logs. This step comes from the performance goal alone.

   CISA says these ratings apply mainly to IT infrastructure, not to operational technology or other non-IT systems.

   Moves Visibility and Analytics (cross-cutting) · Visibility and Analytics: Traditional → Initial

   Matches CISA’s cell in part. CISA’s Initial cell asks for automated collection and analysis of logs and for regularly assessing gaps in visibility; keeping logs where they cannot be edited, and looking at them, is the start of that.

   What CISA’s Initial cell says

   Collection and analysis of logs and events begin to be automated for mission-critical functions, and the processes are regularly checked for gaps in visibility. (Zero Trust Maturity Model, Table 7, page 29; paraphrased, and CISA’s wording says “agency”.)

   Sources for this step

   • CISA Cross-Sector Cybersecurity Performance Goals 2.0: Goal 3.Q, page 26: Maintain log collection and storage
   • CISA Zero Trust Maturity Model: Table 7, page 29: Visibility and Analytics, Initial
8. Step 8: Back up, and test a restore

   Back up what the business cannot run without, keep a copy offsite and offline, and practise restoring it, a part and then the whole, before you need to.

   CPG 2.0 goal 3.O · Maintain system backups and restoration ability (CISA, page 25)

   Cost

   High

   More than 15% of the annual security budget.

   Impact

   High

   Prevents severe or catastrophic harm: the organisation could not carry out its mission.

   Ease

   Moderate

   Takes about 4 to 8 months and moderate technical expertise or management involvement.

   CISA says these ratings apply mainly to IT infrastructure, not to operational technology or other non-IT systems.

   Moves Data · Data Availability: Traditional → Initial

   Matches CISA’s cell in part. CISA’s Initial cell is about off-site backups and some data served from redundant, highly available stores; testing a restore comes from CISA’s backup goal and its small-business page, not from the cell.

   What CISA’s Initial cell says

   Some data is served from redundant, highly available stores (cloud is the example), and off-site backups are kept for data held on the premises. (Zero Trust Maturity Model, Table 6, page 27; paraphrased, and CISA’s wording says “agency”.)

   Sources for this step

   • CISA Cross-Sector Cybersecurity Performance Goals 2.0: Goal 3.O, page 25: Maintain system backups and restoration ability
   • CISA, Cyber Guidance for Small Businesses: The IT lead’s tasks: perform backups and regularly test partial and full restores, and write a restoration plan
   • CISA Zero Trust Maturity Model: Table 6, page 27: Data Availability, Initial
9. Step 9: Move mail and files to managed cloud services

   If you still run your own mail or file server in the office, move them to a managed cloud service. CISA treats this as a bigger change than the rest, for the highest security posture, because few small businesses can keep such servers patched and watched.

   No CPG 2.0 goal: this comes from CISA’s small-business page, under achieving the highest security posture, so there are no ratings to show.

   Moves Applications and Workloads · Accessible Applications: Traditional → Initial

   Matches CISA’s cell in part. CISA’s Initial cell is applications reachable over public networks by authorised users through brokered connections; moving mail and files to managed cloud services is this site’s reading of that.

   What CISA’s Initial cell says

   Some mission-critical applications are reachable over open public networks by authorised users with a need, through brokered connections. (Zero Trust Maturity Model, Table 5, page 24; paraphrased, and CISA’s wording says “agency”.)

   Sources for this step

   • CISA, Cyber Guidance for Small Businesses: Achieving the Highest Security Posture, on premises versus cloud: move mail and file storage hosted in your offices to managed cloud versions
   • CISA Zero Trust Maturity Model: Table 5, page 24: Accessible Applications, Initial