Cyber security is built with a process that keeps running inside the organisation, not with a product that gets installed once. Firewalls, endpoint protection and e-mail security only protect when they are configured correctly. The programme below turns the first 90 days into measurable steps.
Day one: Establish the current state
The first job is to produce an asset inventory. Which servers, endpoints, network devices and cloud resources exist, and who is responsible for each? An asset that nobody knows about is an asset nobody protects. Once the inventory exists, every service reachable from the internet has to be listed.
Week two: Classify by criticality
Every asset has to be classified by the impact of its data and by the business impact of an interruption. That classification gives both the security priorities and the investment plan a single, defensible base.
- Impact analysis: How long do processes stop if this system goes down?
- Data sensitivity: Does it hold personal data or commercial secrets?
- Access requirements: Who needs access, and at which hours?
- Dependencies: Which other services rely on this asset?
Week three: Close the basic control gaps
The first 90 days deliver the highest return on medium effort configuration. Management interfaces exposed to the internet, default passwords, open SMB and legacy protocols are the most common initial access paths.
- Make management interfaces reachable only over VPN or through a bastion host.
- Disable default accounts and enforce the use of privileged accounts.
- Turn off SMBv1, Telnet and management over plain HTTP.
- Route management traffic through a dedicated VLAN and gateway.
- Centralise logs on a server and keep them as tamper resistant records.
Week four: Verify the backups
Most cyber incidents end with data loss. A backup job that reports success is worthless if nobody restored from it. At least one end-to-end restore test has to run within the first 90 days, and the resulting time has to be recorded.
Week eight: People and reporting
Technical controls are only one side of the attack surface; human behaviour is the other. Phishing simulations, a password policy and an incident reporting procedure come into play at this stage. Without a written reporting flow, the first fifteen minutes of a real attack are lost.
Week twelve: Measure and report
A programme can only be managed with measured values. Patch delay, incident count, restore test duration and the share of assets covered by segmentation should be reported every month.
The first 90 days of a security programme define the roadmap for the years that follow. A strong start, combined with the lessons learned during the trial period, builds a durable defence line. The Serventa NOC team can map your network topology and build that roadmap with you.
