2026 Cybersecurity Baseline

Identity and Access

Is multi-factor authentication required for every user account?

High impact

Yes No

Is MFA enforced for email

Yes No

Are administrator accounts separate from day-to-day accounts?

High impact

Yes No

Are shared accounts eliminated or tightly restricted?

High impact

Yes No

Is a password manager deployed to all staff?

High impact

Yes No

Are stale user accounts disabled within 24 hours of departure?

High impact

Yes No

Endpoint Security

Is an EDR solution deployed on every workstation?

High impact

Yes No

Is an EDR solution deployed on every server?

High impact

Yes No

Is EDR monitored 24x7 by a SOC or MDR provider?

High impact

Yes No

Are full-disk encryption (BitLocker / FileVault) enabled on all devices?

High impact

Yes No

Are USB ports controlled or restricted by policy?

Yes No

Are local administrator rights restricted on user workstations?

High impact

Yes No

Network Security

Is a next-generation firewall in place with active threat feeds?

High impact

Yes No

Is guest Wi-Fi isolated from the internal network?

High impact

Yes No

Is DNS filtering deployed (DNSFilter Cisco Umbrella or similar)?

High impact

Yes No

Are IoT devices on a separate network segment?

Yes No

Is remote access via VPN or ZTNA with MFA enforced?

High impact

Yes No

Email Security

Is advanced email security deployed beyond built-in filtering?

High impact

Yes No

Is DMARC configured with p=reject or p=quarantine?

High impact

Yes No

Are SPF and DKIM configured for all sending domains?

High impact

Yes No

Is external sender banner enabled on inbound email?

Yes No

Are users trained to report phishing with one-click reporting?

High impact

Yes No

Patch and Vulnerability

Are OS patches applied within 14 days of release?

High impact

Yes No

Are third-party application patches applied within 30 days?

High impact

Yes No

Are vulnerability scans run at least quarterly?

High impact

Yes No

Are critical vulnerabilities remediated within 15 days?

High impact

Yes No

Backup and Recovery

Are backups performed daily for all critical systems?

High impact

Yes No

Are backups stored immutable or air-gapped against ransomware?

High impact

Yes No

Is a cloud backup copy maintained offsite?

High impact

Yes No

Are SaaS applications (Google Workspace or Microsoft 365) backed up separately?

High impact

Yes No

Are restore tests performed at least quarterly?

High impact

Yes No

Security Awareness

Is annual security awareness training mandatory for all staff?

High impact

Yes No

Are phishing simulations run monthly?

High impact

Yes No

Are training completion and simulation results tracked?

Yes No

AI and Data Security

Is an approved list of AI tools defined for business use?

High impact

Yes No

Are staff trained on what data cannot be shared with public AI tools?

High impact

Yes No

Is shadow SaaS discovery performed to find unauthorized cloud apps?

High impact

Yes No

Is DLP deployed on email and key document repositories?

High impact

Yes No

Monitoring and Response

Is there a 24x7 security monitoring service (MDR or SOC-as-a-Service)?

High impact

Yes No

Are security logs retained for at least 12 months?

High impact

Yes No

Is there a documented incident response plan?

High impact

Yes No

Is the IR plan tested via tabletop at least annually?

High impact

Yes No

Compliance and Documentation

Are written cybersecurity policies approved and reviewed annually?

High impact

Yes No

Are cyber insurance requirements reviewed before renewal?

Yes No

Is a vendor risk list maintained with BAAs / DPAs on file?

High impact

Yes No

2026 Cybersecurity Baseline

Your Information

Identity and Access

Endpoint Security

Network Security

Email Security

Patch and Vulnerability

Backup and Recovery

Security Awareness

AI and Data Security

Monitoring and Response

Compliance and Documentation