Cybersecurity advice tends to focus on sophisticated attacks, which is a strange emphasis given how many real breaches trace back to something ordinary that simply wasn’t in place.
Multi-factor authentication on email, cloud storage, and admin accounts closes off the single most common route into a compromised account.
Backups that have actually been restored once, not just scheduled and assumed to work.
A same-day offboarding process — when someone leaves the company, their access should end that day, not “whenever someone remembers.”
Endpoint protection on every device that touches company systems, including personal phones used for email.
One named person accountable for security, even as a small part of a broader role — ambiguity about ownership is how basic gaps stay open for years.
None of this requires a large budget. It requires someone deciding these aren’t optional, and then actually confirming they’re in place.