Basic protection

Multi-factor authentication
Critical accounts are protected with MFA. Password management
A password manager is in use and shared passwords are being phased out. Backups
Important systems and files are backed up and tested. Updates
Devices and software are updated on a reliable schedule. Phishing awareness
Staff understand common phishing and impersonation tactics.