Skip to main content

Enterprise cybersecurity, cloud security and compliance

Request Assessment

Guides

Practical security guides

Short, step-by-step guides to help you prepare, prioritise and make progress, written by our security team in plain language.

  • Testing2 min read6 steps How to prepare for a penetration test Get more value from your test by planning scope, access and fixes before testing begins.
    1. Decide what matters most: list the applications, networks and cloud accounts in scope, and why they matter to the business.
    2. Choose the right type of test, such as external, internal, web application, API or cloud, or a combination.
    3. Agree the rules of engagement: testing windows, contacts, stop conditions and anything that is off limits.
    4. Prepare access in advance, such as test accounts for each user role, VPN access or allow-listing, and a staging environment where possible.
    5. Tell the right people, including IT, your hosting provider and your monitoring team, when testing will take place.
    6. Plan for the fixes: agree owners and target dates before the report arrives, and book a retest.
    Want expert help? Penetration testing
  • Compliance2 min read5 steps Your first 90 days towards ISO 27001 A realistic sequence for starting an ISO 27001 programme without losing momentum.
    1. Agree the scope, such as which parts of the business, locations and systems are included, and secure leadership commitment.
    2. Run a gap assessment against ISO/IEC 27001:2022 and its Annex A controls to see where you stand.
    3. Carry out a risk assessment and prepare your statement of applicability.
    4. Write the core policies, assign control owners and start closing the highest-priority gaps.
    5. Start collecting evidence, and plan your internal audit and management review before choosing a certification body.
    Want expert help? ISO 27001 and SOC 2 readiness
  • Resilience2 min read6 steps Ransomware readiness checklist The basics that make the biggest difference to whether ransomware stops your business.
    1. Enforce multi-factor authentication on email, remote access and every admin account.
    2. Patch internet-facing systems quickly, starting with known exploited vulnerabilities.
    3. Keep at least one copy of your backups offline or immutable, and test that you can restore from it.
    4. Limit admin rights, and keep admin accounts separate from everyday accounts.
    5. Segment your network so that one infected machine cannot reach everything.
    6. Write an incident response plan, and practise it with leadership, including who decides what and who to call.
    Want expert help? Business continuity and recovery
  • Email2 min read5 steps How to stop payment fraud by email Simple technical and process controls that stop most fake invoice and bank detail scams.
    1. Enforce multi-factor authentication on every mailbox, including shared and finance mailboxes.
    2. Check regularly for hidden forwarding and inbox rules, which attackers use to watch conversations.
    3. Protect your email domain with SPF, DKIM and DMARC, so others cannot easily send email as you.
    4. Confirm any change of bank details by calling a number you already know, never one given in the email.
    5. Encourage finance teams to pause whenever a payment request is urgent or asks them to keep it secret.
    Want expert help? IAM security

More resources

Looking for something specific?

Find quick answers in our FAQs, look up a term in the glossary or try our free security health check.

Take the health check Read our FAQs