Corporate network security: 7 steps to a secure process

Table of Contents

• Why business cybersecurity is not optional
• Step 1: Start with a risk assessment and IT system security audit
  • What a Security Audit Entails in Practice
• Step 2: Defence against ransomware and malware
  • Backups That Cannot Be Encrypted
• Step 3: Business data backup and recovery after an attack
  • Start by Classifying Your Data
  • Define RPO and RTO; Without Them, Backups Are Pointless
  • The 3-2-1 Rule and Why It's Not Enough on Its Own
  • Test the Recovery, Not Just the Backup
  • What to Do If the Backup Is Also Encrypted
• Step 4: Firewalls, Intrusion Detection, and Access Control
• Step 5: Cybersecurity Training for Staff and Phishing Tests
• Step 6: Incident Response Plan for Cyber Attacks
  • The First 60 Minutes: Sequence of Actions
  • Roles and Responsibilities: One Person in Charge
  • Communication Plan: Internal and External
  • Tabletop Exercises: Practice the Plan
  • Reporting Obligations and Legal Aspects
• Step 7: Updates, Vulnerability Management, and Continuous Monitoring
• Frequently Asked Questions

Last updated: 18 October 2026

Why business cybersecurity is not optional

Business cybersecurity is the work that protects your data, systems, and operations from cyber attacks. It is not a tool you buy and forget, but a process that needs to be maintained. Companies that neglect this work tend to pay dearly for it later.

Many managers believe that small businesses are not targets. This is wrong. Cyber threats look for weaknesses, not big names. Cyber security guidelines from the Communications Regulatory Authority show that basic defences are most important.

Here we go through seven steps. Each one builds on the next.

Step 1: Start with a risk assessment and IT system security audit

You cannot protect what you do not know you own. The first step is to map out what data you store, where it is located, and who has access to it. An IT system security audit is a systematic review of all of this.

What a Security Audit Entails in Practice

The audit covers four aspects:

• Data: what information is sensitive and where is it stored
• Systems: what software and servers are in use
• Access: who can access what and with what permissions
• Vulnerabilities: what is lacking in defences

The result is a priority list. Don't try to fix everything at once. Start with what could cause the most damage.

Step 2: Defence against ransomware and malware

Defence against ransomware is the decision that an attacker cannot access your data, even if they get into the system. Ransomware encrypts files and demands payment. Malware sneaks in and causes damage silently.

The defence needs to work in three places:

1. On devices: updated software and well-known applications
2. On the network: a firewall that stops unknown traffic
3. In behaviour: staff who recognise signs of fraud

Backups That Cannot Be Encrypted

Here is the key point. If your backup is on the same network as your computer, ransomware can encrypt it too. The backup needs to be separate and preferably immutable for a certain period.

• Backup in a separate location
• Backup that cannot be deleted or modified
• Regular testing of recovery

Step 3: Business data backup and recovery after an attack

Backing up company data is not just a technical matter but the business's life insurance. If the data disappears, the operation disappears with it. A good backup plan not only answers how often, where, and how long, it also answers which data is most important and how quickly it needs to be restored.

Start by Classifying Your Data

Not all data is equally important. Classify it according to what happens if it is lost:

• Essential operational data: financial accounts, customer records, contracts. If they are lost, operations will cease.
• Important but reproducible: emails, project documents, internal reports. Can be partially reproduced but costs time.
• Minor: cache, temporary files, old versions that no one uses.

The classification determines how often to back up and how long to store them. Essential data should be backed up daily or more often; minor data can wait a week.

Define RPO and RTO; Without Them, Backups Are Pointless

Two concepts govern the entire backup plan:

• RPO (Recovery Point Objective): how much data loss is acceptable? If you can afford to lose the last hour of sales registrations, then the RPO is one hour. If you cannot afford to lose anything, the backup must be continuous.
• RTO (Recovery Time Objective): how long can the system be down? For an online store, an hour can cost a lot of money; for a small accounting department, a day might be acceptable.

These two values should come from management, not just IT. They are a business decision, not a technical one.

The 3-2-1 Rule and Why It's Not Enough on Its Own

The basic rule still applies: three copies, two different media, one copy off-site. But ransomware has made it more complicated. If the copy is accessible from the same network as the live system, an attacker can encrypt it too.

Therefore, the copy needs to be:

• Isolated: not on the same network as the production system
• Immutable for a period: neither deletable nor modifiable within the retention period
• Encrypted: so it is useless if it falls into the wrong hands

A common setup is to have one copy on-site for fast recovery, one off-site for disaster recovery, and one in immutable storage in the cloud for ransomware protection.

Test the Recovery, Not Just the Backup

A backup that has never been tested is not a backup. It is a hope. The test needs to be realistic:

1. Choose one system and restore it to an isolated location.
2. Measure the time it takes and compare it to the RTO.
3. Check that the data is intact, open files, run tests, check dates.
4. Record the results and adjust the plan if the time is too long.

Test at least one system per quarter and the entire system once a year. If the test is not recorded, it did not happen.

What to Do If the Backup Is Also Encrypted

If ransomware manages to encrypt the backup, there must be a copy that was not accessible at the same time. This is why immutable storage is important: it does not allow deletion or modification within a certain period, even if passwords are stolen. If such a copy exists, it is possible to recover without paying a ransom.

Finally: backup is not a project that ends. It is a process that needs to be tested, measured, and updated as systems change.

Contact Us →

Step 4: Firewalls, Intrusion Detection, and Access Control

Firewalls and intrusion detection are the outer line of defence. The firewall blocks unnecessary traffic. Intrusion detection monitors and raises alarms if anything unusual happens.

Access control is the internal defence. It ensures that each employee only sees what they need. Three rules apply:

• Least privilege: grant only the access that is needed
• Multi-factor authentication: passwords alone are not enough
• Regular review: revoke access when an employee leaves

Step 5: Cybersecurity Training for Staff and Phishing Tests

Cybersecurity training for staff is the investment that yields the fastest returns. Most cyber-attacks start with a single click on the wrong link. That click comes from a person, not a device.

Phishing tests are exercises where you send a simulated phishing email to staff. The goal is not to punish anyone. The goal is to see where training is lacking.

• Start with short introductions, not long lectures
• Test with realistic but harmless emails
• Review results without scolding
• Repeat regularly

Critical thinking is the best defence. If an email seems too good to be true, it probably is.

Step 6: Incident Response Plan for Cyber Attacks

An incident response plan is the script that dictates who does what when a cyber-attack occurs. Without it, valuable hours are lost in chaos. Most companies have some document, but few have tested it. That is the difference between a plan and actual response capability.

The First 60 Minutes: Sequence of Actions

When an attack is suspected, the sequence is important. This is a common process that many follow:

1. Confirm: is this a real attack or a mistake? Record the time and what was seen.
2. Isolate: block the infection while an investigation takes place. Do not shut down everything, as this can destroy evidence.
3. Report: inform the response team according to a phone number list that is printed and accessible offline.
4. Preserve: ensure logs and backups are preserved before restarting systems.
5. Assess: determine if operations need to be stopped, customers informed, or external assistance sought.

Roles and Responsibilities: One Person in Charge

At the time of an attack, someone needs to lead. A group without a leader makes slower decisions. Define the following roles, even in a small company:

• Incident Manager: makes final decisions and is responsible for communication with management.
• Technical Lead: investigates and isolates.
• Communications Manager: handles messages to staff, customers, and the media.
• Legal and Privacy Officer: assesses reporting obligations and legal risks.

If the company is small, one person can fill more than one role, but write it down. Unwritten roles are not roles.

Communication Plan: Internal and External

Communication is what often goes wrong. You need:

• Internal List: phone numbers and email addresses of staff not on the same system as the attack.
• External List: customers, suppliers, insurance company, police, and relevant authorities.
• Message Templates: prepared text for the most common situations, so you don't have to write from scratch under pressure.
• One Spokesperson: not everyone talks to the media. One speaks, others refer to them.

Tabletop Exercises: Practice the Plan

An unpractised plan is just a document in a drawer. A tabletop exercise is a meeting where the team goes through a prepared scenario and asks: what do we do next?

• Choose a scenario that is realistic for your business, for example, ransomware in an accounting system or a phishing email to management.
• Set aside 60-90 minutes and have one person lead.
• Record what cannot be answered; that is the real risk.
• Repeat every 6-12 months and after every real incident.

A tabletop exercise is an inexpensive way to find holes in the plan without having to face a real attack.

Reporting Obligations and Legal Aspects

In Iceland, it must be assessed whether incidents need to be reported to the Data Protection Authority and possibly to the Communications Regulatory Authority or other government agencies, depending on the nature of the data and the incident. This should be part of the plan, not something investigated in the middle of a crisis. Record who assesses the reporting obligation and when.

Finally: a response plan is not a document that is written once. It is practised, updated, and tested. A company that has practised its response is more likely to limit damage and restore operations faster.

Step 7: Updates, Vulnerability Management, and Continuous Monitoring

Updates close the holes that are already known. Vulnerability management is the process of finding and fixing them. Monitoring is what ensures everything stays in order.

Here is a simple process that works:

Factor	How often	Responsible
Software update	Monthly	IT
Access review	Quarterly	Manager
Security testing	Annually	Third party
Backup review	Monthly	IT
Staff training	Twice a year	Everyone

Frequently Asked Questions

How can a small business increase its cybersecurity without its own IT department?

Start with three things that require little effort: enable multi-factor authentication on all main access points, ensure company data backups go off-site, and hold a short cybersecurity awareness session for staff twice a year. Next comes a risk assessment, documenting which data is sensitive and who has access to it. Many smaller operators then hire an external party for an IT security audit to get an independent view of the situation.

How often should company data be backed up?

Company data backups should be automated and daily for data that changes every day, such as accounting, case files, and business documents. Additional backups can be taken weekly or monthly. More important than frequency is that at least one backup is stored offline and that restoration is tested regularly. A backup that has never been tested is not a backup but a hope. Write down how long restoration may take and keep it in mind when choosing the frequency.

How does a company protect itself against ransomware?

Protection against ransomware is based on four pillars: backups that are offline and immutable, updated software, multi-factor authentication for remote access, and staff who recognise phishing emails. Ransomware most often enters through open remote access or clicking on an attachment, so training and access control are more important than the most complex software. If backups are separated from the network, the company can refuse to pay the ransom and rebuild the systems on its own terms.

What should a company do if it is subjected to a cyber-attack?

The first step is to implement a response plan that should be in place beforehand: who manages the actions, who contacts service providers, and who assesses the reporting obligation. Take a backup of systems before shutting them down, isolate infected machines from the network, and change passwords for main access. Record everything that happens, as it will be useful for both recovery and in a report to customers or regulators. After the attack, the cause should be reviewed, and the vulnerability that was exploited should be closed.

---

Cybersecurity requires discipline and continuous work, and that is precisely where many companies run into problems. We at nexIT take this work off your shoulders with comprehensive system management and cybersecurity solutions. We offer expert services in security audits and data protection, as well as secure data backup and recovery. Get in touch for a clear picture of your situation.