01 / PHISHING · 1 MIN READ
Pause before you trust an urgent message
A familiar name does not prove a message is genuine. Attackers impersonate managers, suppliers, and banks to push people into opening files, signing in, or sending money.
- Verify unusual requests. Call a number you already trust, rather than one included in the message.
- Open services directly. Use a saved bookmark or the official app instead of an unexpected login link.
- Report suspicious messages. Let your IT team know, especially if you opened an attachment or entered credentials.
One action today: Agree how your team will independently verify payment and bank-detail changes.
Source: NIST — Phishing
02 / ACCOUNT PROTECTION · 1 MIN READ
Protect accounts with more than a password
A stolen password should not be enough to open your business accounts. Multi-factor authentication (MFA) adds another verification factor, but the method you choose matters.
- Enable MFA wherever available. Start with email, administrator accounts, and services holding sensitive information.
- Prefer phishing-resistant methods. Where supported, use FIDO/WebAuthn options such as security keys or passkeys. SMS and one-time codes can still be phished.
- Keep access appropriate. Use unique passwords stored in a password manager, limit administrator privileges, and remove access when people leave.
One action today: Check whether your business email offers phishing-resistant sign-in.
Source: NIST — Multi-Factor Authentication
03 / BUSINESS CONTINUITY · 1 MIN READ
A backup needs a recovery test
A successful backup notification does not prove your business can recover. Files, databases, and applications must be restorable when hardware fails, mistakes happen, or ransomware strikes.
- Identify what matters. Decide how much recent data you can afford to lose and how quickly work must resume.
- Protect separate copies. Include offsite and offline copies, restrict access, and encrypt stored backups.
- Test realistic recovery. Restore sample files and test the systems they depend on. Record the time taken and resolve any failures.
One action today: Restore an important file to a safe test location and check that it opens correctly.
Source: NCSC New Zealand — Implement and test backups