From “I’m Too Small to Be a Target” to Cyber-Strong
When I started working with Decypher a little over a year ago, I knew almost nothing about cybersecurity. I figured I was fine because my laptop had Microsoft Defender and I paid for McAfee. That covered me, right? I felt I was too small a fish for anyone to bother with. In my head, identity protection was for celebrities and influencers, not for regular old me. I assumed the big state actors were contained by CISA and had bigger targets than me. The list goes on.
I was wrong on all counts.
This October, as part of CISA’s 2025 Cybersecurity Awareness Month, I’ve put together three short, practical 30-day plans that show what really strengthens your security posture—that is, how ready your systems and people are to detect and respond to attacks.
SMBs & Co-Managed IT Partners | 30-Day Cybersecurity Checklist
Running a small or midsize business means juggling payroll, vendors, and clients while trying to keep systems running. Cybersecurity often falls to the bottom of the list—but one weak password or missed update can take a system offline. This 30-day plan offers low-cost, high-impact steps based on the CISA SMB Cyber Essentials Toolkit to help you raise your baseline.
A Simple 30-Day Plan
Week 1: MFA and Password Manager
Owner: Ops or IT lead
Outcome: MFA enabled for finance and admin; password manager deployed.
- Turn on multi-factor authentication (MFA) for finance, admin, and remote access.
- Use a password manager with shared vaults where needed.
- Keep a “who to contact” card for lockouts or breaches in two safe locations. (Tip: MFA adds a second proof of identity beyond a password—think app code or hardware token.)
Week 2: Automatic Updates and Holdouts
Owner: IT admin
Outcome: Auto-updates enabled on 95% of devices; holdout list documented.
- Enable automatic updates on laptops, servers, and firewalls.
- Keep a short “fragile apps” list that need manual patching windows.
- Verify update status with a simple report.
Week 3: Inbox Protections and Phish Drill
Owner: Security champion or HR trainer
Outcome: One phish simulation run; staff briefed in under 15 minutes.
- Add “external sender” banners and link protection to email.
- Run a short phishing drill and follow with five minutes of coaching.
- Add a one-click “report phish” button.
Week 4: EDR, Response Plan, Segmentation, Backup Test
Owner: IT lead + management
Outcome: EDR deployed on all endpoints; backup restore tested successfully.
- Deploy endpoint detection and response (EDR) with alerts sent to the right person.
- Write a one-page response plan: who investigates, when to isolate, who to notify.
- Segment your network with separate SSIDs for staff and guest devices; keep IoT on its own VLAN.
- Complete one backup restore test and confirm results are logged
For Healthcare: 30 Days to HIPAA-Ready Cybersecurity & Compliance
For healthcare teams, cybersecurity can’t come at the expense of care. You’re protecting PHI under HIPAA while managing tight schedules and limited staff. This 30-day helps you meet HIPAA cybersecurity best practices and stay compliant by showing you how to secure systems, protect patient data, and document safeguards. It draws on the HHS 405(d) Health Industry Cybersecurity Practices (HICP), designed for hospitals and small providers alike.
A Simple 30-Day Plan
Week 1: SSO + MFA for Clinical Systems
Owner: IT and Compliance leads
Outcome: SSO and MFA enabled for EHR, e-prescribing, and imaging systems.
- Enable single sign-on (SSO) with MFA for clinical and admin apps.
- Use stronger factors for privileged accounts and systems that touch PHI.
- Confirm session timeouts match workflow and review privileged access lists.
Week 2: Device Baseline and Patch Sweep
Owner: IT support team
Outcome: Baseline logged for all carts and shared devices; patch compliance recorded.
- Record OS, apps, and firmware versions for shared devices.
- Push patches on a schedule that fits change windows.
- Verify encryption and screen-lock settings.
Week 3: Network Segmentation and Access Paths
Owner: Network engineer
Outcome: Patient, clinical, and admin networks fully segmented.
- Separate patient Wi-Fi, clinical devices, and admin systems.
- Limit management interfaces to a controlled path with MFA.
- Keep an access log and review quarterly.
Week 4: EDR, Tabletop, and Log Verification
Owner: IT security team
Outcome: Incident response tested; logs queryable for audit.
- Enable EDR on clinical workstations with clear alert ownership.
- Run a 45-minute tabletop exercise and turn actions into tickets.
- Confirm events flow to your SIEM and test a simple search by user and device.
Get the Healthcare Compliance Kit
Download the Healthcare Compliance Kit—your quick-start set of HIPAA guides and checklists.
What’s inside:
- HIPAA Quick-Start Guide (what “addressable” means, top safeguards, how to document)
- The New Compliance Curve white paper (breach scenarios, action plans, technical frameworks)
- eBook: Is Your Practice Ready? (executive-friendly brief for leadership and staff)
- eBook: Co-Managed IT for Healthcare (how to cut costs and boost compliance)
For Family Offices & UHNW Homes | 30 Days to Enterprise-Grade Security
In family offices and UHNW homes, work and personal life run on the same networks. This plan treats each property like a branch office, applying enterprise-grade controls with minimal disruption. It follows CISA’s Shield Up guidance for high-value targets, and built for discretion, accountability, and peace of mind.
A Simple 30-Day Plan
Week 1: Identity Hardening
Owner: Trusted family IT advisor or security chief
Outcome: MFA and password manager adopted by family and staff.
- Turn on MFA for email, finance, and remote access.
- Use a password manager for everyone; enable passkeys where available.
- Keep a “who to contact” card with emergency IT and security numbers in two secure, easy-to-find places.
Week 2: Home Network Segmentation
Owner: Integrator or IT partner
Outcome: IoT and AV isolated; SSIDs set for user groups.
- Segment networks with separate SSIDs for family, staff, vendors/visitors, and guests.
- Isolate IoT and AV from work devices using VLANs or dedicated gateways.
- Restrict remote access to building systems with MFA and current access lists.
- Rotate guest network credentials after events.
Week 3: Safer Communication and Travel
Owner: Trusted family IT advisor or security chief
Outcome: MFA and password manager adopted by family and staff.
- Enable monitored DNS and email protections (external labels, link checks).
- Deliver a 15-minute phishing refresher with a one-page handout.
- Create a simple travel device protocol (prefer hotspots, loaner devices, no public Wi-Fi).
Week 4: EDR, Vendor Access, Backup Test
Owner: Security consultant or integrator
Outcome: EDR active on laptops; vendor accounts audited; backup tested.
- Deploy endpoint protection and response (EDR) on laptops and desktops with alert routing to a trusted partner.
- Maintain a one-page vendor access ledger listing system, person, scope, and expiry.
- Review the ledger quarterly and use it to confirm least privilege and logging for all active vendor accounts.
- Complete one backup restore test and keep one copy offline.
Schedule a Private Consultation
Beyond October | Keep the Culture Strong
Cyber readiness is a habit, not a month-long initiative or “project.” After 30 days, you will have built momentum and a baseline to measure against. Keep training light and frequent, rotate backups, review access lists, and test your response plan twice a year.
Further Reading: Decypher blog archive
See where you stand with a baseline assessment. It takes about 30 minutes and could reveal gaps before attackers do.
Share this post: