The ten practices below are the ones that consistently separate security programs that hold up under pressure from those that only look good on paper. They center on resilience, identity, cloud security, detection, measurable risk management, people, suppliers and governance.
This is a working checklist. For each practice we describe what good looks like and a concrete first step a CISO, IT director or business owner can take this quarter. For the deeper operating model behind these items, see Core Best Practices for CISOs; for the leadership and board side of the role, see The CISO of 2025: More Than a Guardian.
The ten practices at a glance
- Cyber resilience strategy: plan to absorb, recover from and adapt to incidents, not only to prevent them.
- Identity and access management: strong authentication, least privilege and continuous verification.
- Cloud security architecture: secure-by-design deployments that are audited continuously.
- Zero trust implementation: verify every user, device, API and transaction.
- Incident response planning: tested, current playbooks and practiced decision-makers.
- Continuous monitoring and threat detection: find and contain intrusions quickly.
- Risk management and metrics: quantify risk and report it in business terms.
- Security awareness and training: behavior change, measured by outcomes rather than completions.
- Vendor and supply chain security: security built into procurement and ongoing oversight.
- Governance, compliance and collaboration: clear ownership and working relationships with legal, finance and IT.
Resilience and incident response (practices 1 and 5)
What good looks like. Each critical business process has an agreed maximum downtime. Backups for the systems behind those processes are immutable or offline, and restores have been tested at realistic scale. The incident response plan names who decides what, including who can take systems offline, who talks to customers and regulators, and who engages outside counsel and forensic firms. NIST’s revised incident response guidance, SP 800-61 Revision 3, released in April 2025, frames response as part of overall risk management under CSF 2.0 rather than a standalone IT process, which is the right mindset.
First step. Run a two-hour ransomware tabletop with the executive team and one full restore test of your most important system. Both almost always reveal gaps worth fixing before a real incident does.
Identity, zero trust and cloud (practices 2, 3 and 4)
These three belong together because identity is now the perimeter. The 2024 wave of data theft from Snowflake customer accounts succeeded largely because stolen credentials worked on accounts without multi-factor authentication. The Change Healthcare ransomware attack that year began, according to the parent company’s CEO in congressional testimony, with a remote-access portal that lacked MFA.
What good looks like. Phishing-resistant MFA, such as passkeys or FIDO2 keys, on all privileged and remote access. Administrative rights granted just in time rather than permanently. Joiner, mover and leaver processes that remove access within hours. Zero trust principles, as described in NIST SP 800-207 and CISA’s Zero Trust Maturity Model, applied across identity, devices, networks, applications and data. In the cloud, infrastructure defined as code with guardrail policies, and configuration monitoring that flags public storage buckets or overly broad roles as they appear.
First step. Inventory every account with administrative rights, across on-premises directories, cloud consoles and SaaS admin panels, and confirm each one uses phishing-resistant MFA. Remove the accounts nobody can explain.
Detection and risk metrics (practices 6 and 7)
What good looks like. Endpoint detection and response on every server and laptop, central logging for identity, cloud and email events, and someone watching around the clock, whether an internal team or a managed detection provider. Attackers move fast once inside; we describe how fast in ultra-fast network intrusions. Risk is reported as a short list of business scenarios, with trends in a few stable measures such as time to contain incidents, time to patch known-exploited vulnerabilities on internet-facing systems, and tested recovery time.
First step. Pick five metrics, baseline them now, and report the same five every quarter. Consistency builds credibility with a board faster than any dashboard redesign.
People, vendors and governance (practices 8, 9 and 10)
Awareness. Good programs are short, frequent and tied to real behavior: how quickly staff report suspicious messages, whether finance follows callback procedures for payment changes, whether the help desk verifies identity before resetting passwords. Security champions in each department carry the message further than any central team can. Measure reporting rates and procedure compliance, not course completion.
Vendors and supply chain. Verizon’s 2025 Data Breach Investigations Report found third-party involvement in breaches had doubled to about 30%. Security review belongs in procurement, before contracts are signed, with requirements for breach notification, MFA and right to audit. After signing, review which vendors and SaaS integrations hold access into your systems, and cut what is not needed. See SaaS supply chain and OAuth attacks for why integrations deserve particular attention.
Governance and collaboration. Map your obligations, whether SEC disclosure rules, HIPAA, PCI DSS, state privacy laws or customer contracts, to a single control framework such as NIST CSF 2.0 so one set of evidence satisfies many audits. Establish standing relationships with legal, finance and IT leadership so decisions during an incident are made by people who already trust each other. Our cybersecurity compliance and regulatory framework services are designed for this mapping.
First step. List your top 20 vendors by data access, and confirm each has a current security review and a named internal owner.
A note on trade-offs. None of these ten practices is free. Stronger authentication adds friction at login, faster patching occasionally breaks an application, and vendor reviews slow procurement. The CISO’s job is not to eliminate that friction but to spend it where it buys the most risk reduction, and to explain the choice openly. A program that tries to do all ten at full depth in one year usually finishes none of them. Pick the two or three where your gaps are largest, fund them properly, and show measurable progress before widening the scope.
Frequently asked questions
Which of the ten practices should come first?
For most organizations, identity and resilience. Phishing-resistant MFA on privileged and remote access blocks a large share of common intrusions, and tested backups determine whether a successful attack is an inconvenience or a crisis.
Do small businesses need all ten?
Yes, but scaled down. A 30-person firm can meet most of these with a managed detection service, a password manager and MFA, tested cloud backups, a one-page incident plan and a basic vendor list. The principles are the same; the tooling is smaller.
Is zero trust a product we can buy?
No. Zero trust is an architecture and a set of principles. Products can help implement parts of it, but it is achieved gradually by tightening identity, device, network and data controls.
Putting the checklist to work
Delana Technologies helps organizations assess themselves against these ten practices and build a prioritized plan, including fractional CISO support, zero trust roadmaps and incident readiness. We also help teams govern the security risks of AI and agentic tools. Call 239.414.5126 or contact us to get started.
Sources: NIST SP 800-61 Revision 3 (April 2025); NIST SP 800-207, Zero Trust Architecture; CISA Zero Trust Maturity Model 2.0; NIST Cybersecurity Framework 2.0; Verizon 2025 Data Breach Investigations Report; Mandiant reporting on the Snowflake customer account campaign (2024); UnitedHealth Group CEO testimony to the US Senate Finance Committee on the Change Healthcare attack (May 2024).