Eighteen habits that count

Each habit is something a 5 to 50 person firm can do and show. Open one to see how to do it, the evidence that proves it, and the rules it counts towards.

Governance

• 01 A named security lead One person owns security decisions and reports to the owners. NIS2 2 ISO 27001 2 NIST CSF 2.0 2
• 02 A written security policy A short document says how you protect information, and staff have read it. NIS2 1 ISO 27001 1 NIST CSF 2.0 1
• 03 A yearly risk review Once a year you list what could go wrong and decide what to do about it. NIS2 2 GDPR 1 ISO 27001 1 NIST CSF 2.0 3

Know what you have

• 04 A list of devices and data You know which laptops, phones, accounts and data you have. NIS2 1 GDPR 1 ISO 27001 1 NIST CSF 2.0 1
• 05 A list of key suppliers You know which suppliers hold your data or run your systems. NIS2 1 GDPR 1 ISO 27001 2 NIST CSF 2.0 3

People

• 06 Security training for staff Everyone learns to spot phishing and handle data safely, at least once a year. NIS2 2 ISO 27001 1 NIST CSF 2.0 1
• 07 Access given and removed on time New staff get only the access they need. Leavers lose it on their last day. NIS2 1 ISO 27001 4 NIST CSF 2.0 2

Accounts and access

• 08 Multi-factor authentication Email and key systems ask for a second step, such as an app code, at sign-in. NIS2 2 GDPR 1 ISO 27001 2 NIST CSF 2.0 1
• 09 A shared password manager Staff keep passwords in a password manager instead of reusing them. NIS2 2 ISO 27001 1 NIST CSF 2.0 1

Devices and systems

• 10 Updates applied within two weeks Computers, phones and software are updated within two weeks of a fix. NIS2 2 GDPR 1 ISO 27001 1 NIST CSF 2.0 1
• 11 Encrypted laptops and phones If a laptop or phone is lost, nobody can read what is on it. NIS2 1 GDPR 2 ISO 27001 2 NIST CSF 2.0 1
• 12 Malware protection on every device Every device has malware protection that is switched on and up to date. NIS2 1 ISO 27001 2 NIST CSF 2.0 2

Spot problems

• 13 Sign-in logs and alerts Sign-ins and changes are logged, and someone actually looks at the alerts. NIS2 1 GDPR 1 ISO 27001 3 NIST CSF 2.0 3

When things go wrong

• 14 A written incident plan You have written down who does what when something goes wrong. NIS2 1 GDPR 1 ISO 27001 2 NIST CSF 2.0 4
• 15 Reporting contacts ready You know who to tell and how fast: the NCSC, the Data Protection Commission, customers. NIS2 1 GDPR 2 ISO 27001 1 NIST CSF 2.0 1

Recover

• 16 Automatic daily backups Important data is copied every day, automatically, to somewhere separate. NIS2 2 GDPR 1 ISO 27001 1 NIST CSF 2.0 1
• 17 A restore tested this year You have restored files from a backup this year and timed how long it took. NIS2 2 GDPR 2 ISO 27001 1 NIST CSF 2.0 3
• 18 A plan for keeping going You know how you would keep working if your systems were down for a week. NIS2 1 GDPR 1 ISO 27001 2 NIST CSF 2.0 3