Five controls. Answered honestly.

Every device that connects to the internet sits behind a firewall, and so does the office network. In practice that means the router your provider installed is configured rather than plugged in, the administrative password is not the one printed on the sticker, and nothing is reachable from the internet that does not need to be.

The part that catches people out is remote working. A laptop in somebody's kitchen is not behind your office firewall, so the firewall on the laptop itself has to be doing the job. That is usually a configuration change rather than a purchase.

Devices and software ship set up for convenience rather than safety. This control asks you to undo that: remove the software nobody uses, disable the accounts and services nobody needs, change every default password, and make sure a screen locks itself when somebody walks away.

It also covers how people prove who they are. There are a few acceptable routes through the password requirements, and which one suits you depends on what your devices and cloud services can enforce. Multi-factor authentication on cloud services is the one piece almost everybody ends up needing, and it is also the single most valuable change on this page.

Everything is supported by its vendor and everything is patched promptly. The scheme puts a clock on it: the updates that fix the serious vulnerabilities have to be applied within fourteen days of release. That applies to operating systems, browsers, applications, phones and firmware.

This is where most failures live, and they are rarely about laziness. They are about the one machine running software that only works on an operating system the vendor stopped supporting three years ago. Unsupported software has to be removed, or genuinely separated from everything else, and finding those cases early is a lot cheaper than finding them during an audit.

People have their own accounts, those accounts have only the access the job needs, and administrator rights are separate from the account somebody reads email on. Accounts are created through a process, and more importantly they are removed through one when somebody leaves. Multi-factor authentication protects the accounts that matter.

The honest version of this control for a small business is usually a list: the shared login three people use, the former employee whose account still works, and the fact that everybody is an administrator because it was easier. None of those take long to fix once they are written down.

Every device in scope is protected, by anti-malware software that is kept up to date, or by only allowing approved applications to run. Most small businesses use what is already built into their operating system, which is perfectly acceptable as long as it is genuinely switched on and reporting.

The common gap is phones and tablets. They are in scope, people read work email on them, and they tend to be nobody's job. Bringing them into a device management setup fixes this control and a good part of the previous two at the same time.