Who this page is for
This page is written for executives, CISOs, IT and risk leaders as well as compliance and data protection functions in mid-sized and large organisations.
Why cybersecurity is a management topic
A serious incident can hit business operations, delivery, reputation and compliance all at once. Cybersecurity is therefore not a pure IT topic but a leadership responsibility. It belongs in the risk register, reporting cycles and strategic planning.
With NIS2 and DORA, executive accountability is also being anchored in EU regulation. The content here is orientation and does not replace legal advice.
Which risks are realistic?
In practice the dominant patterns are phishing, ransomware with data theft, compromised identities, vulnerabilities in externally exposed systems and risks through service providers.
A realistic assessment does not need worst-case drama. It needs an honest look at business processes, data and critical systems.
Baseline controls
A solid baseline typically includes:
- MFA, ideally phishing-resistant
- Patch management with priority on external systems
- EDR on all endpoints and servers
- Backups with tested restore, at least one offline or immutable
- Logging and central review of critical sources
- Awareness with simple reporting paths
- A documented and rehearsed incident plan
Security as a continuous process
Security is never finished. Threats change, systems change, people change. Effective programmes run in regular cycles of assess, prioritise, implement, verify and refine.
Short cycles with measurable results outperform annual mega-projects with little visible impact.
How to prioritise
Invest first where risk, business value and effort align best. A pragmatic order:
1. Secure identities (MFA, privileged accounts).
2. Ensure recovery (backups, restore).
3. Patch and vulnerability work for externally exposed systems.
4. Detection and response (EDR, SIEM or MDR).
5. Awareness and incident exercises.
6. Supply chain and third parties.
Practical scenario
A manufacturer rolls out MFA, closes seven-year-old domain accounts, hardens patching for VPN and mail, adds EDR and runs a yearly ransomware tabletop. Six months later an attack is detected and stopped early via EDR and SIEM. Damage: limited. Lessons learned are documented.
Legal note
The content of this page is for orientation. For concrete regulatory questions - for example the applicability of NIS2 or DORA - a qualified legal review is required.
Checklist
- Security ownership named at executive level
- Risk register with top risks updated yearly
- MFA and privileged access management
- Patch management with clear priorities
- EDR and meaningful logging in place
- Offline or immutable backups, restore tested
- Detection via SIEM, SOC or MDR
- Rehearsed incident response process
- Awareness programme and reporting culture
- Third-party and supplier risk reviewed structurally
Frequently asked questions
+What budget is appropriate?
Common benchmarks range from roughly five to ten percent of the IT budget, depending on industry and risk. Conscious prioritisation matters more than a fixed percentage.
+Build or buy?
Typically risk and governance internal, operational detection often as a managed service. Clear interfaces and a minimum of internal expertise are important.
+How often should the incident plan be rehearsed?
At least once a year as a tabletop, complemented by more realistic exercises for critical functions.
Related topics
SMEs do not need enterprise security architecture, but they do need the right basics. This page shows which measures deliver the most impact on a limited budget and which common mistakes are easy to avoid.
The NIS2 directive raises the cyber security bar in the EU noticeably. This page offers editorial orientation - not legal advice.
A security operations centre combines people, process and technology to detect cyber incidents early, handle them in a structured way and learn from them. This page covers tasks, models and common pitfalls.
A security incident requires a clear process, rehearsed roles and prepared communication. Improvising during an incident wastes time and creates mistakes. This page covers the phases, responsibilities and common pitfalls.
Awareness works when it is continuous, relevant and fairly measurable. A yearly mandatory training is not enough. This page shows what good organisational awareness looks like.
Ransomware remains one of the most expensive cyber risks. It is typically the result of a chain of weaknesses rather than a single click. This page covers typical patterns, effective controls and an orderly first response.
MFA significantly reduces the risk of compromised accounts. This page explains which methods actually work, where the weak points are and how to prioritise rollout in practice.
Backups are a core defence against data loss and ransomware. This page explains the 3-2-1 rule, offline and immutable backups, restore tests and common mistakes.
Microsoft 365 is the central workspace and identity ecosystem for many organisations. This page outlines the key security building blocks without admin step-by-step instructions.
Cloud security combines safe configuration, strong identities, good logging and clear responsibility. This page outlines the core building blocks.