Reduce risk before an incident
Security Hardening For Business
A practical starting point for strengthening user accounts, administrator access, email, DNS, devices and recovery. No single setting prevents every attack; layers of sensible controls make it harder for one mistake to affect the whole organisation.
“Trust takes years to build and can be lost in an instant.”
Start with identity
Protect the accounts that control email, app sign-ins and password resets first. Turn on MFA, restrict administrator access, then improve visibility and recovery across the rest of your systems.
Jump to a section
01Users and sign-in
Turn On MFA For User Accounts
Require multi-factor authentication (MFA), also called two-step verification, for every account that supports it. Prioritise work email, cloud services, remote access, finance systems and administrator accounts.
- Choose the strongest practical sign-in method each service supports, especially for administrators and accounts that can approve payments or reset other accounts.
- Give each person their own account. Avoid shared logins and use unique passwords; a password manager can help staff keep them separate.
- Tell users not to approve unexpected MFA requests or share verification codes. Review sign-in alerts and investigate unfamiliar activity.
- Check recovery email addresses, phone numbers and MFA methods so they belong to the organisation and the right user.
02Administrator access
Limit And Separate Admin Access
Administrator accounts can change security settings and regain access to other accounts. Keep their number small and give each person only the permissions needed for their role.
- Use a separate administrator account for administrative work; use a standard account for email and everyday browsing.
- Require MFA for privileged accounts and review the administrator list regularly, including supplier and former staff access.
- Remove or reduce access promptly when someone changes role or leaves.
- Document an emergency recovery route and protect it carefully, so the organisation can regain control if normal sign-in fails.
03Email and app recovery
Secure The Account That Can Reset The Rest
Many organisations use one work email address to register for apps or receive password-reset links. If someone controls that inbox—or the company sign-in used for single sign-on—they may be able to regain access after app passwords are changed.
- Secure the mailbox and company identity account first, using a separate trusted device if compromise is suspected.
- Review recovery details, MFA methods, active sessions, inbox rules, forwarding and connected applications.
- Then reset affected app accounts through the apps’ official recovery pages. Do not rely on reset links sent to an inbox you have not secured.
- For Microsoft 365 or another managed service, coordinate changes with the administrator or IT provider so account recovery and evidence are handled together.
04Devices and recovery
Keep Devices Updated And Supported
Account protections work best alongside maintained devices, appropriate endpoint security and a clear route for reporting suspected incidents.
- Install operating-system, browser and application updates promptly; remove software and accounts that are no longer needed.
- Use appropriate endpoint protection and make sure alerts are reviewed by someone responsible.
- Record who staff should contact and how to report a lost device, suspicious activity or suspected compromise.
05Staff policy and expectations
Adopt An Acceptable Use Policy (AUP)
A practical AUP explains how people are expected to use organisation-owned accounts, devices, networks, applications and data. Keep it relevant to the tools your team actually uses.
- Set expectations for email, web browsing, approved cloud services, AI tools, remote work, personal devices and handling business information.
- Explain how to report a lost device, suspicious message, unexpected MFA prompt or suspected account compromise, and identify who staff should contact.
- Share the policy during onboarding and when it changes. Give staff a short explanation and ask them to confirm they have read and understood it.
- Review it regularly and after significant technology changes or incidents. Apply the rules consistently and proportionately.
06DNS and visibility
Move DNS To Cloudflare For Greater Insight
Using Cloudflare as the authoritative DNS provider can show DNS-query insights. If you also want HTTP traffic analytics and Cloudflare’s web protections, the supported website records need to route through its proxy. Changing nameservers alone does not proxy website traffic.
Keep mail and other non-web services configured correctly. Proxy only records that serve supported website traffic, following the hosting provider’s instructions.
Plan The DNS Handover Carefully
- Inventory the current zone. Record every A, AAAA, CNAME, MX and TXT record, including SPF, DKIM, DMARC and domain-verification entries.
- Compare the import. Check Cloudflare’s imported records against the current DNS provider and the website host’s exact setup instructions.
- Change nameservers only when ready. Update them at the registrar after the zone is complete, then test the website, email and other critical services.
- Use the right proxy setting. DNS analytics cover queries to the zone; HTTP request analytics and proxy protections apply to web traffic routed through Cloudflare.
A DNS move does not transfer domain ownership. Keep the registration with your registrar and retain a copy of the working DNS zone so you can restore records if needed.
07Unmanaged apps and devices
Find The Technology The Business Cannot Control
Shadow IT includes apps, cloud services and devices used for work without the organisation’s knowledge or security oversight. Personal phones or laptops, unapproved file-sharing services and AI tools can all create risk if they can access business accounts or information.
- Build a practical inventory of work-connected devices and services. Ask staff what they use, and review sign-in, endpoint and cloud-service records where available.
- For each device or service, check what business data it can access, who manages it, whether MFA is enabled and how access is removed when it is no longer needed.
- Set clear rules for personal devices and approved apps. Where a device cannot meet the organisation’s minimum safeguards, limit its access to business data or provide an approved alternative.
- Make it straightforward for staff to request suitable tools. A workable approval route can reduce the temptation to adopt unmanaged services.
The NCSC explains how to identify and reduce Shadow IT, and how to manage the added risks of personal devices used for work: Shadow IT guidance · Bring your own device guidance.
08Supplier and supply-chain security
Check Your Suppliers’ Security Processes And Procedures
Understand which suppliers your organisation depends on, what systems or information they can access, and what security and recovery processes they have in place. Focus due diligence on the impact if a supplier or service is compromised or unavailable.
- Map important dependencies. Record critical suppliers, the services they provide, the information they handle, their system connections and any important subcontractors.
- Ask about security operations. Find out how the supplier manages access and MFA, staff training, device security, vulnerability reporting and software updates. Request evidence that is proportionate to the risk.
- Agree incident procedures. Know who to contact, how quickly the supplier will notify you of a suspected incident, what information and cooperation they will provide, and how you will coordinate response and recovery.
- Check continuity and recovery. Ask whether business continuity and disaster recovery plans are documented and tested, what service restoration targets apply, and what alternatives exist if the supplier is unavailable.
- Keep assurance current. Set clear security responsibilities in contracts, review critical suppliers periodically and revisit the assessment when the service, access or risk changes. Remove access when it is no longer needed.
Use the NCSC’s supply-chain cyber security guidance and supplier assurance questions to shape a proportionate process.
09Backups and business continuity
Does Your Backup Plan Fit Your Business?
A backup plan should reflect how much data the organisation can afford to lose and how long it can operate without key systems. Set recovery targets for critical services, then test whether your backups and restore process can meet them.
- Set a Recovery Point Objective (RPO): the maximum amount of recent data the organisation can afford to lose, usually expressed as a period of time. How often must each critical system be backed up to stay within that limit?
- Set a Recovery Time Objective (RTO): how long the organisation can accept a system or service being unavailable before it needs to be restored. Include the time needed to recover, check and safely return the service to use.
- Agree your operational tolerance: how long can people continue working without the data or system? Which services must return first, and what manual workarounds are realistic while they are unavailable?
- Use immutable backups where possible. These are locked against alteration or deletion for a defined retention period, helping protect copies if ransomware reaches the live network. Secure the backup account and the settings that control the lock; immutability is not a substitute for offline or isolated copies.
- Test restores regularly. Confirm backups are usable and clean before recovery, compare actual restore times and data loss with your RPO and RTO, and update the plan when business needs change.
10Ransomware response
Don’t Pay A Ransom Expecting It To End The Attack
Our guidance is not to pay. Payment does not guarantee that you will regain access to systems or data, or that stolen data will be deleted. The UK National Cyber Security Centre (NCSC) warns that organisations that pay are more likely to be targeted again. Criminals may return with another demand, including by repeating or adapting the same scam.
Focus on containing the incident, preserving evidence and planning a safe recovery with your incident-response provider. Check whether clean backups can be restored, and review the NCSC’s ransomware response guidance.
11Optional third-party check
Review Exposed Settings After Containment
After the incident is contained, you may want to consider an external scan service such as Solvbeat to review TLS, DNS, SPF and DMARC settings.
Optional third-party service; do not enter passwords, recovery codes or confidential incident details.
12Keep learning
Use Trusted, Current Guidance
13Get external support
Feeling Overwhelmed? You Don’t Have To Handle It Alone.
Contact your IT provider or a trusted incident-response specialist for help planning the next steps. If you would like to speak with IT Life-Raft, call +44 (0) 1743 668200.
CRC links are for business cyber-resilience guidance and services. If an attack is in progress, contact your IT provider, insurer or incident-response specialist.
14Frequently asked questions
Common Questions About Preparing For A Cyber Attack
We Have Never Suffered An Attack. Are We Likely To Be Targeted?
Businesses of every size can be targeted. Attackers may look for weaknesses they can exploit, such as exposed accounts, weak or reused passwords, missing MFA, unpatched software or staff being pressured into urgent actions. Some attacks are automated; others focus on a particular person or organisation. A clean history does not prove that every account or device is secure. Reduce common weaknesses and make it easy for staff to report anything suspicious.
Should We Have A Separate, Unpublished Email Address For Recovery?
A separate recovery contact outside your main business email domain can help if that domain or its sign-in service is unavailable. Keep it private, protect it with MFA and a unique password, limit access to named people, and share it only with verified suppliers and essential stakeholders. Do not use it for everyday work.
What Should A Business Continuity And Cyber Recovery Plan Include?
List the services that must keep running, their dependencies, recovery order, RPO and RTO targets, and practical workarounds while systems are down. Record who can make decisions and how to reach your IT provider, insurer, bank, critical suppliers and staff if email is unavailable. Include how to assess any personal data breach and find the ICO’s current reporting guidance. Keep an accessible copy outside your normal systems, test the plan and update it when things change.
What Does An Immutable Backup Mean?
It is a backup copy locked so it cannot be changed or deleted for a set period. That can stop ransomware or a compromised account from tampering with that copy, provided the backup service and retention controls are properly protected. Immutable does not automatically mean offline, malware-free or restorable, so keep access restricted, maintain an isolated copy where practical, and test restores. NCSC guidance on preparing backups and recovery.
Who Should We Contact If We Feel Overwhelmed?
Start with your IT provider or a trusted incident-response specialist. Section 13 has external support options and a call button.