Cyber hygiene
The basic habits that stop most attacks
Cyber hygiene is the set of basic measures and habits a company keeps up routinely and without exceptions — software updates, access control, multi-factor authentication, a password manager and tested backups. It is not a defence against a targeted state actor, but it stops the overwhelming majority of what actually hits companies.
What it covers
This is a routine, not a project. Most successful attacks do not exploit a sophisticated vulnerability; they use a forgotten account belonging to a former employee, an unpatched system, or a password someone reused elsewhere that leaked in someone else's breach.
That is exactly why hygiene is largely organisational. Tooling without a rule about who revokes whose access when people leave holds for a few months and then falls apart.
- Regular updates to operating systems and applications.
- Access control — above all revoking it when people leave.
- Multi-factor authentication everywhere it is available.
- A password manager instead of one password used everywhere.
- Backups whose restore you have genuinely tried at least once.
Why the law requires it
Minimum cyber hygiene is one of the areas regulated entities have to cover under NIS2. The reasoning is pragmatic: it is the cheapest measure with the largest effect, so the regulator asks it of everyone regardless of size.
It is also the area that lives or dies on people. The best password policy will not help if someone on the team enters their credentials on a spoofed page — which is why cybersecurity training belongs to hygiene as much as tooling does.
Want the team to handle it in practice?
See the cybersecurity trainingFrequently asked questions
Is cyber hygiene enough to satisfy NIS2?
No. It is one of the areas the implementing decree lists, alongside risk analysis, incident handling, business continuity and supply-chain security. Without it, though, the other measures are built on sand.
How often should backups be tested?
At least once a year, and after any significant system change. An untested backup is only an assumption — a fair number of companies discover during an incident that the backup job ran fine but nothing can be restored from it.
Is multi-factor authentication really necessary?
No other measure has that ratio of effect to effort. A leaked password is worthless on its own if the attacker has no second factor, and password leaks from third-party services are routine today.