Good security does not need an enterprise budget. Most breaches get in through a few basic gaps, and any organisation can close them. This is the checklist we go through with new clients.
1. Passwords and sign-in
Use strong, unique passwords and a password manager
Reused passwords are the easiest way in. Give every member of staff a password manager so each account gets a long, unique password that nobody has to remember. It costs little and closes off a whole category of attack.
Turn on multi-factor authentication (MFA) everywhere
MFA blocks most account-takeover attempts even after a password has leaked. Switch it on for email, Microsoft 365 or Google Workspace, online banking and every remote-access tool. If you only do one thing on this list, do this.
2. Protect your data
Back up, then test the restore
Follow the 3-2-1 rule: three copies of important data, on two types of media, with one copy off-site or in the cloud. Until you have restored from a backup, you do not know that it works. Test a real restore at least once a quarter.
Keep software updated
Attackers scan for known vulnerabilities that have not been patched. Turn on automatic updates for operating systems, browsers and applications. Replace hardware and software that no longer gets security updates.
3. Secure the network and devices
- Firewall & secure Wi-Fi: use a proper business firewall, keep guest Wi-Fi separate from your internal network, and change default device passwords.
- Endpoint protection: run reputable anti-malware, managed centrally, on every laptop and server.
- Least privilege: give staff access only to what their role needs, and close accounts on the day someone leaves.
4. Train your staff
Tools block a lot, but phishing is aimed at people. Short, regular training on how to spot a suspicious email, a fake invoice or a "CEO" asking for an urgent transfer pays for itself the first time it stops a mistake. Make it safe for staff to report a bad click without blame. The faster you hear about it, the less damage it does.
5. Plan for an incident
Decide now what you will do when something goes wrong. A short written incident-response plan should say who is called first, how to isolate an affected system, who communicates with staff and clients, and how you recover from backup. Run through it once as a drill. That teaches more than a thick binder nobody opens.
6. Know your obligations
Data protection rules apply in the region, and they differ by country. Check which ones cover your organisation:
- ECOWAS: Supplementary Act A/SA.1/01/10 on personal data protection (2010) sets a regional framework that member states are expected to follow.
- Côte d'Ivoire: Law No. 2013-450 on the protection of personal data applies to organisations that process personal data there.
- Liberia: check the current national requirements and any guidance from your sector regulator, for example the Central Bank of Liberia for financial institutions.
Whatever applies to you, publish a plain-language privacy notice, collect only the personal data you need, and be ready to explain where it is stored and how it is protected. If you are unsure, take legal advice.
← Back to news and insights