Close-the-basics week

A self-serve pack for a 5–30 person firm or a serious home office. Checkboxes stay in the browser. You buy nothing — if after the week you want an outside look, use the form.

This is not a certification course and it does not replace an assessment. It is a work order so you stop losing accounts and invoices before you buy another tool.

Tick items as you go — checklist state returns after a refresh (stored locally in the browser).

Week rules

• One person owns the plan (the IT owner, or you).
• Each day ends with a fact (done / consciously deferred with a date), not the slogan “we care about security”.
• Do not open new services “while you are at it”. Close what already faces the network first.

Full order map: Security order for a small business.

Day 1 — accounts and MFA {#day-1}

Goal: nobody critical signs in with a password alone.

• List accounts with access to company mail, banking and admin panels
• Turn on MFA for the owner mailbox and for administrative accounts
• Prefer passkeys / FIDO2 keys where possible — MFA checklist
• Remove a shared “office@” password or schedule a move to named accounts (with a date)

Day 2 — separate admin from daily work

Goal: mail and the browser do not sit on an account that can change everything.

• Create (or confirm) a separate, named administrator account
• Daily work runs from a normal account
• Review the minimum administrator account standard
• Write down who still has Global Admin / Super Admin / local Administrator

Day 3 — email: forwarding and spoofing

Goal: you know who can send “as the company” and whether anyone silently forwards a mailbox.

• Review forwarding rules / filters on critical mailboxes
• Check OAuth / connected apps with mailbox access
• Read the domain SPF / DKIM / DMARC (even if p=none) — intro
• Assign a DMARC report owner or a date when you will

Day 4 — what faces the internet

Goal: a listen list with owners — no “temporary” ports without an expiry.

• Fill the exposure worksheet for what you know
• Check RDP, panels, VPN, cameras, “test” publications
• Every publication has an owner or goes on a close-down list
• If RDP is on the internet — a close plan today / tomorrow, not “sometime” — why

Day 5 — backup with a restore proof

Goal: not “we have copies”, but the date of the last successful restore.

• Know where the copy lives and whether ransomware on one host also wipes the backup
• Run a small restore test (one file / one database) or put it on this week’s calendar
• Record the result with the worksheet
• Decide who gets the alert when a copy fails

Day 6 — vendors and remote access

Goal: external access has a name, a scope and an end date.

• List who outside the firm has VPN / RDP / a panel (accounting, software house, “IT friend”)
• Walk the vendor access checklist
• Disable accounts from finished projects
• Remote desktop “for a moment” without MFA / VPN goes on the fix-or-disable list

Day 7 — who answers the phone

Goal: for a transfer, BLIK or ransomware there is no “call everyone” scramble.

• Name the first contact outside office hours
• Read who does what in an incident
• Print or save in the phone: bank (official number), IT, counsel if needed
• Walk what an insurer will ask — even without a policy: it is a fact list

After the week

You have three columns in your head or a notebook: present, missing, deferred with a date.

Sensible next steps:

1. Microsoft 365 / Google Workspace baseline — if you live in office cloud
2. Sample assessment report shape — so you know what an outside result looks like
3. Hygiene 48h — if you work alone and want the files for one workshop (79 PLN gross), or a baseline review of one target
4. Contact form — when you want to agree assessment or IT cleanup scope

The product stays free. The form is for implementation or a second pair of eyes — not for unlocking the list.