1. Refresh and Test Your Phishing Awareness
Your team has likely completed security training. But is it sticking? The human element remains a primary factor in breaches, with phishing as a top vector. Instead of just running another annual session, recheck the effectiveness of your program. Use
phishing simulation tools to send test emails and measure click rates. Use the results to identify departments or individuals who need targeted refreshers. Training should be continuous, not a one-time event, to keep pace with new scam tactics and reinforce good habits.
2. Audit Your Multi-Factor Authentication (MFA) Gaps
Requiring MFA is a foundational security practice that significantly hardens accounts against credential theft. This month, the habit to recheck isn't whether you use MFA, but where it's missing. Conduct an audit across all critical applications, cloud services, and privileged accounts. Are there legacy systems, service accounts, or third-party platforms that haven't been integrated? Closing these gaps is one of the most powerful steps to reduce your attack surface.
3. Dry-Run Your Incident Response Plan
A dusty incident response plan on a shelf is useless in a crisis. A real incident unfolds at machine speed, leaving no time for coordination debates. Recheck your plan by running a tabletop exercise with key stakeholders from IT, legal, communications, and leadership. Walk through a realistic scenario, like a ransomware attack. Have key contacts for forensic investigators and legal counsel changed? Does everyone know their role? This exercise will reveal gaps and ensure your team can act decisively.
4. Verify Your Patching Cadence
Most companies have a policy for patching software, but execution often lags. Unpatched vulnerabilities are a common entry point for attackers. Go beyond assuming patches are being applied. Pull logs and scan reports to verify that critical updates for operating systems, web browsers, and applications are being deployed promptly. If you find significant delays, investigate the cause—it could be a process failure or a technical issue that needs solving.
5. Conduct an Access Control Audit
The principle of least privilege dictates that users should only have access to the data and systems necessary for their jobs. Over time, however, permissions creep. Recheck access levels across the organization. Pay special attention to employees who have changed roles and ensure their old permissions were revoked. Most importantly, verify that every former employee's access has been completely terminated from all systems. An audit often reveals surprising and unnecessary privileges that create risk.
6. Re-evaluate Critical Vendor Security
Your company’s security is only as strong as your supply chain. A breach at a third-party vendor with access to your systems or data is a breach against you. Don't just onboard vendors; recheck their security posture annually. For critical vendors, ask for updated security assessments like SOC 2 reports or ISO 27001 certifications. Classify vendors based on the level of risk they pose to your organization and focus your deepest reviews on those with the most access.
7. Test Your Data Recovery, Not Just Backups
A successful backup notification is not the same as a successful recovery. Many businesses discover their backups are corrupted or incomplete only during an actual emergency. The habit to recheck is your ability to restore. Schedule a test restore of a critical server, database, or file share to a sandbox environment. Can you meet your recovery time objectives? Document the process and confirm that the restored data is usable. A backup that hasn't been tested is only a hope.
8. Review Your Physical Security Controls
In a digital world, it’s easy to forget about physical security, but it remains a crucial layer of defense. Recheck the basics. Are server rooms and network closets properly secured? Is there a formal process for logging and monitoring visitors? What are the procedures for when a laptop or company phone is lost or stolen? Ensure that your physical access controls are audited just like your digital ones, restricting entry to sensitive areas to only authorized personnel.
9. Foster a Proactive Security Culture
Ultimately, cybersecurity depends on people. A strong security culture turns every employee into a part of your defense system. This month, recheck how security is perceived in your company. Does leadership actively model good habits? Is reporting a suspicious email easy and encouraged? Consider celebrating employees who spot real threats. When security is seen as a shared responsibility rather than just an IT problem, the entire organization becomes more resilient.
