Key takeaways
- 1Assume a breach will happen. Resilience is how fast you detect it, contain it and restore service.
- 2Phishing-resistant authentication, fast patching of known-exploited vulnerabilities and immutable backups stop or limit most serious incidents.
- 3Most of your attack surface belongs to your suppliers. Know which ones could stop your business.
The ten questions
Each question has an answer that should come with evidence, not reassurance.
- Do we know everything we run? A current inventory of assets, data, identities and third parties, including AI tools staff use.
- Can an attacker phish their way in? Phishing-resistant MFA (FIDO2 security keys or passkeys) for administrators and remote access at the very least.
- How fast do we patch what is being exploited? Vulnerabilities on CISA's Known Exploited Vulnerabilities catalogue should be closed in days, not months.
- Could we restore from backups if everything online were encrypted? Immutable, offline or logically isolated backups, with restores actually tested.
- How long would it take us to notice? Mean time to detect, and whether logging covers cloud, identity and SaaS, not just endpoints.
- Who decides what in an incident? A playbook with named people, legal and regulatory reporting clocks (four business days for SEC disclosure, 24 and 72 hours under NIS2), and a rehearsal in the last year.
- Which suppliers could stop us? Concentration risk in cloud, payments, identity and managed services, with exit and continuity plans.
- Is privileged access controlled? Least privilege, just-in-time admin rights and monitoring of the accounts that can do the most damage.
- Are we moving to zero trust? Access decided per request on identity, device and context (NIST SP 800-207), rather than trust based on being inside the network.
- Is our cryptography ready for what is next? An inventory and a post-quantum plan, because long-lived data is already exposed to harvest-now, decrypt-later attacks.
Good answers sound like numbers
Percentages of systems covered, days to patch, hours to restore, dates of the last exercise. If the answers are adjectives, the controls probably are too.
Sources
- CISA: Known Exploited Vulnerabilities catalogue (opens in a new tab)
- CISA: Implementing phishing-resistant MFA (fact sheet) (opens in a new tab)
- NIST SP 800-207: Zero trust architecture (opens in a new tab)
- NCSC: Cyber Assessment Framework (opens in a new tab)
General information, not legal or regulatory advice. Standards and deadlines move; check the primary source before relying on a date.