Practical security guides
Practical starting points for small IT teams, using existing tools and free resources where possible.
These guides use selected NIST CSF 2.0 alignments. They are not official crosswalks or complete framework implementations. Priority and effort are suggestions, not risk scores or deadlines. Check business impact, vendor instructions, licenses and obligations before making changes. Test before wider rollout.
Baseline catalog review: 2026-09-22 · Updated guides show their own review dates. Source versions appear in the linked publications.
Browse all free worksheets and templates →Low-budget starting path
Start with what you have
Start with important sign-ins, a file restore test and a discussion about who acts when an account may be compromised. Each guide includes a free worksheet or settings to check in services you already use.
Existing Microsoft 365 and Windows capabilities vary by subscription and device. Basic Office apps alone do not include every cloud security feature; check eligibility and operational costs before relying on a control.
1 · Protect access
Set up and verify MFA →Start with privileged accounts and recovery access. Check enforcement, not enrollment alone.
2 · Test file recovery
Test a safe restore →Use made-up test files and a separate destination. Record what came back.
3 · Rehearse response
Run a one-hour tabletop →Discuss a fictional account compromise and record decision owners and gaps.
14 remediations