Protect systems and information

Treat the protection of your systems and information as an ongoing business responsibility. Give employees and outside providers only the access they need, and remove access promptly when someone leaves or changes roles.

Secure accounts with strong passwords and multifactor authentication, which adds another identity check when signing in. Keep devices and software updated, and establish clear rules for collecting, using, sharing, and retaining sensitive information.

Train people to recognize suspicious messages and verify unusual requests involving money, passwords, or confidential records. Assign responsibility for monitoring security and investigating concerns, using qualified technical help where needed.

Make these practices part of normal operations.