Cybersecurity Hygiene: A Practical Business Baseline

Cybersecurity hygiene is the repeatable work that keeps ordinary weaknesses from becoming avoidable incidents. It is not a product bundle or a one-time checklist. A useful baseline assigns owners, defines evidence, covers people and technology, and is reviewed whenever the environment or threat changes.

Establish ownership and inventory

List internet-facing services, endpoints, cloud applications, privileged accounts, business-critical information, vendors, and operational dependencies. Assign a business owner and technical owner for each critical service. Record support status, recovery priority, and the evidence used to confirm the inventory rather than assuming an automated scan is complete.

Reduce common access risk

• Require MFA for remote, cloud, email, and administrative access.
• Prefer phishing-resistant methods for higher-risk accounts when supported.
• Separate daily and administrative identities.
• Disable dormant accounts and review vendor access.
• Apply least privilege and document approved exceptions.

Maintain and observe the environment

Use a risk-based patch process with testing, deployment windows, exceptions, and installation verification. Centralize enough logs to investigate authentication, administrative, endpoint, backup, and network events. Tune alerts around material behavior and test escalation instead of measuring success by alert volume.

Prepare for disruption and recovery

CISA’s ransomware guide recommends protected backups and recovery testing alongside access, asset, and network controls. Define who can isolate systems, contact providers, preserve evidence, notify leadership, and authorize restoration. Exercises should expose missing contacts, credentials, dependencies, and decision rights before an incident.

Next step for your environment

Score the current environment against a short baseline and turn every gap into an owned, dated action. An ITECS assessment can provide a documented starting point.

Record the accountable owner, baseline, source date, decision, exceptions, acceptance evidence, and review trigger. Test consequential changes in a bounded environment, maintain a rollback path, and verify the real result before closing the work. Product names, availability, pricing, legal requirements, and security guidance can change; recheck the primary sources whenever the decision is renewed or the environment changes.

If you need an independent baseline before changing production systems, start with an ITECS technology and security assessment and keep the resulting evidence with the decision record.

Sources and update trigger

• CISA — Cybersecurity Performance Goals
• NIST — Cybersecurity Framework 2.0
• CISA — StopRansomware Guide

Review trigger: Review after a material system, vendor, identity, threat, incident, or CISA/NIST guidance change.