A small business does not need a “full SOC” to stop losing accounts and invoices. It needs order: first what opens the door, then what lets you recover after failure, monitoring last.
This page is an index. Each step points to existing material or to agreeing a scope.
1. Accounts and MFA
Separate the daily account from the admin account. Enforce phishing-resistant MFA on email and privileged accounts. Check who still has access “because they helped once”.
2. Company email
Before buying another filter, clarify who may send as the domain and what SPF / DKIM / DMARC show.
3. What faces the internet
RDP, panels, VPN, cameras, a “temporary” port. A listen list and an owner for every publication.
4. Backup and restore test
A copy without a restore test is hope. Check retention, separation from production, and one successful restore.
5. Vendors and remote access
Accounting, a software house, remote desktop “for a moment”. Who has access, for how long, how you revoke it.
6. Only then SIEM / lab
Once accounts, email, exposure and backup have owners, monitoring stops being a bin of alerts without context.