Guides
Close the gaps before someone uses them
Practical, plain-English guides for small offices. Each one is built from the real cases on this site, so you can see exactly what goes wrong when the control is missing.
Guide · OffboardingEmployee offboarding checklist: how to cut off a former employee's access the same dayA fired employee deleted 20,000 files 2 days later because her login still worked. A same-day offboarding checklist for small offices, staff and contractors.Guide · Payment fraudHow to stop fake invoices, changed bank details and fake-boss payment requestsBusiness email compromise cost Americans $2.77 billion in 2024. The payment rules that stop fake invoices, changed bank details and deepfake calls from a boss.Guide · Caller verificationHow to verify callers before password resets, and protect your phone number from SIM swapsThe MGM attack reportedly began with a help desk call. How to verify callers before password and MFA resets, and how to lock your number against SIM swaps.Guide · PatchingHow a small business keeps software and devices patched, and why default passwords must goWannaCry's fix was out 2 months before the attack. A simple patching routine for small offices: what to update first, old equipment, and default passwords.Guide · Ransomware backupsBackups that survive ransomware: offline copies, tested restores and a one-page planMaersk's login system survived NotPetya only by luck. How a small office builds offline backups, tests restores, and writes a one-page ransomware plan.Guide · Multi-factor authenticationWhich two-step login actually stops phishing, and how a small office rolls it outText codes, app prompts or security keys? Which kind of multi-factor authentication stops phishing, where to turn it on first, and a 4-week rollout plan.Guide · Vendor accessHow to manage vendor, IT provider and contractor access to your systemsThe Target breach began with a contractor's billing login. How a small office limits, protects and closes access for IT providers, vendors and contractors.Guide · ComplianceWISP requirements for tax preparersWhat the FTC and IRS require, and what goes in the plan.
Close the same gap
Want the policies written for you?
The free Heist Control Checklist walks through the controls behind every case on this site in about ten minutes. For ready-made policies, the Policy Pack has five editable templates, and the Insider Threat Kit covers risks from inside your own team.