1. Train employees to spot and avoid email-based phishing attacks.

2. Follow a 3-2-1 backup method for all critical and sensitive data.

3. Test employees with phishing tests to ensure they apply their knowledge.

4. Create cybersecurity processes around Vulnerability Management and Incident Handling.

5. Adopt two-factor authentication on all critical internet-accessible services.

6. Perform a risk assessment every two to three years.

7. Adopt a password manager for better personal/work password hygiene.

8. Enable SPAM filtering solutions on all emails.

9. Require 14+ character passwords in your Governance Policies.

10. Purchase cybersecurity insurance for when catastrophe strikes.