Good Cyber Hygiene Checklist

“[T]he relevant inquiry here is a cost-benefit analysis, that considers a number of relevant factors, including
the probability and expected size of reasonably unavoidable harms to consumers given a certain level of
cybersecurity and the costs to consumers that would arise from investment in stronger cybersecurity.”
– FTC v. Wyndham, (3rd Cir. Aug. 24, 2015)

n Start with a risk assessment n Adequate logging and retention

n Written policies and procedures focused on n Incident response plan
cybersecurity and tailored to company
n Third-party security risk management program
— Expectations for protection of data
n Firewall, intrusion detection, and intrusion
— Monitoring and expectations of privacy prevention systems
— Confidentiality of data n Managed services provider (MSP) or managed
security services provider (MSSP)
— Limits of permissible access and use
n Cyber risk insurance
— Social engineering
— Passwords policy & security questions
— BYOD
Assess
n Training of all workforce on your policies and Cyber Risk
procedures, first, then security training
n Phish all workforce (incl. upper management) Reassess
& Refine
n Multi-factor authentication Strategic
Planning
n Signature based antivirus and malware detection
Cyber Risk
n Internal controls / access controls Management
n No default passwords Program
n No outdated or unsupported software Tabletop
Testing Deploy
n Security patch updates management policy Defense
Assets
n Backups: segmented offline, cloud, redundant
Develop,
n Use reputable cloud services Implement &
Train on P&P
n Encrypt sensitive data and air-gap hypersensitive
data

Spencer Fane LLP | spencerfane.com