Six questions for a small team
The NIST Cybersecurity Framework 2.0 groups all security work into six functions. For a team of five or fifty they turn into six plain questions.
Who decides, and what do we have?
Govern: one named person is responsible for security, even when it is a small part of their job. They know which laws and contracts apply and what the team would do without its computers for a week.
Identify: a list of devices, accounts, programs and the places where important data lives. A spreadsheet is enough. You cannot protect what is not on the list.
How do we protect it, and how would we notice?
Protect: a second sign-in step on every account that offers it, automatic updates, backups that are tested, administrator rights only for those who need them, and a short conversation with every newcomer about phishing.
Detect: someone reads the alerts from the mail service, the antivirus and the bank. Everyone knows where to report something odd, and reporting is welcome.
What do we do on the day, and after?
Respond: a one-page plan kept on paper. It says who to call, how to disconnect a device, who talks to customers and which authorities must be told.
Recover: restore from the backup, change passwords, tell the people affected, and write down what you would do differently. Then update the plan.
This note is our own plain-language summary. For the full guidance, read the original: https://csrc.nist.gov/pubs/sp/1300/final
Next noteHow to read a suspicious message
A plan on one printed page beats a perfect plan nobody has read.