Where to start with cyber security when you've been handed the problem
Your leadership team has asked what the organisation is doing about cyber security, and the question has landed on you.
If you’re a leader of a health, NGO or community organisation, you’re likely not a security specialist. You’ve probably got a quote for penetration testing, a folder of policies someone wrote a few years ago, an IT provider who says things are under control, and a budget that won’t stretch to all of it.
We see this often. It’s how responsibility for cyber security typically arrives in healthcare organisations. It gets added to the workload of an operations manager, finance lead, chief executive or practice manager who was never hired to run a security programme.
The first thing to know is that you don’t need to start by buying something. You start by working out what matters.
Don't start with a penetration test
Penetration testing is useful. Done at the right time, it can show how easily someone could get into your systems, and it gives you evidence you can action.
The trouble is that it answers a question you’re not ready to ask yet. Before asking how somebody might break into your systems, you need to know which systems matter, what information they contain and what the organisation would need back if those systems disappeared tomorrow. If you run it early in the programme you’ll get a report full of findings that you can’t prioritise, and about systems you haven’t yet decided are important.
It belongs later in the sequence, once you’ve trained your people, worked out what you own and who supports it, and you’ve patched your systems. At that point it’s checking work you’ve already done, which is what it’s good for.
If you’ve already started engaging with a penetration testing organisation, don’t cancel it. Ask whether it can wait until you’ve been through the four steps below, then use that time to tighten the scope so they test the systems that actually matter. Most testers will be happy to do this, and you’ll get far more out of the report.
Step One: Work out what systems and information you have
Start with the systems and information the organisation actually depends on. Don’t set out to build a perfect asset register. A spreadsheet is fine, and one you finish this month beats a register you never finish.
For each important system, record the following:
What it does
What important data it holds
Where that data is stored
Who supplies or supports it
Whether it is still supported and maintained
Who inside the organisation is responsible for it
That last one about the internal owner is important. Your IT provider may administer the system, but they don’t own the business consequences if it disappears. Someone inside your organisation needs to be able to say how important the system is, who depends on it, and what would happen if it went down. Naming that person is the easy part. Getting them to accept it is the real task, and everything that follows depends on it.
Do the same with the information itself. You don’t need a complicated classification scheme. You simply need enough distinction to recognise that a public brochure, an internal roster and a patient, client, employee or donor record require different levels of security treatment.
At this point you’re not trying to solve anything. You’re building the picture you need to make sensible decisions.
Step Two: What do you need back and how fast?
Now ask the most useful question in the whole exercise: if it all disappeared today, what would we need back first?
It can be helpful for you to really picture this properly. Imagine the building burns down, your systems are encrypted, your cloud provider goes down, or your main server fails. What does the organisation need in order to keep operating? And here’s the part that focuses the mind: what does it need back, and by when, before the damage stops being an IT problem and becomes a financial one?
Some systems may need to be restored within hours. Others may comfortably wait until tomorrow or next week. So for each important system, there are two questions. How long can we operate without it? And how much information could we afford to lose?
Security specialists call these the Recovery Time Objective (RTO) and Recovery Point Objective (RPO). The terminology matters far less than the decision.
Then put the systems in restore order. If ten are down at once, which one comes back first, which is second, and which can wait? That order should drive your backup and recovery arrangements, and it’s usually the first time anyone has written it down.
Here’s why we push this so hard. It’s tempting to spend a large proportion of a small security budget trying to stop every possible attack. Prevention matters, but you should assume that eventually something will fail. Somebody clicks a dodgy link, a supplier has an outage, hardware dies, credentials are compromised, or a control stops doing its job. Once you accept that, the smart money goes on recovery first.
A backup isn’t much use if it can’t restore the information within the time the organisation needs it. Nor is a daily backup necessarily appropriate if losing a full day of clinical notes or operational data would be unacceptable. Work out what recovery has to look like before you spend more on prevention.
Step Three: Find out what you are already doing
Now sit down with whoever manages your technology, whether that’s an internal IT team, an IT contractor or a managed service provider. This isn’t a competence test, and it shouldn’t feel like one. You’re simply establishing the starting position.
Ask what’s already happening with:
Software support and patching
Multi-factor authentication
Administrator access
Endpoint protection
Backups and whether restores have been tested
What happens when staff join or leave
Security awareness training
Monitoring and alerting
What happens when a security incident is detected
You may discover that quite a lot is already being done, which is great.
It's worth being clear about who does what. Your IT provider’s role is generally to implement and operate technical controls. The organisation still needs someone to decide whether those controls are appropriate for its risks, whether more is needed, and which problems deserve money first. Those are different jobs, and they work best alongside each other.
Step Four: Find the gaps and decide where it matters
You can now compare what the organisation needs with what is actually in place. The difference is your gap list. Resist the urge to immediately turn those gaps into a remediation programme and prioritise them instead.
Ask which gaps could stop the organisation operating, expose sensitive information, cause an unacceptable loss of data, or leave you unable to recover. Then ask what it would realistically take to close each one.
This is where proportionality matters. A 20-person community organisation with one IT contractor and no dedicated cyber security budget shouldn’t be trying to reproduce the security programme of Health New Zealand. Plenty of the security checklists and frameworks arriving from central agencies are useful, but most of them assume a level of resources you don’t have.
Good cyber security is not about doing everything. It‘s about knowing which risks matter enough to deal with now, which can wait, and which the organisation is prepared to accept.
What can you achieve in the first month, with no budget?
More than you might expect.
By the end of the first month, you can reasonably have:
An initial list of your important systems and data
A named business owner for each, who has agreed to it
An understanding of which systems are most critical
Initial recovery time and data loss expectations
A prioritised restore order
A picture of the controls already in place
Your most important gaps identified
The beginnings of a 90-day plan
Almost all of that is conversations and decisions, rather than purchases.
Two things are worth adding. Start the staff and awareness conversation now, even if it’s only a short email each month about what to watch for and how to report it. It costs nothing, and your people are the control that scales furthest.
Then check what you’re already paying for. Most organisations we work with are on a Microsoft license that includes cyber security features nobody has switched on, with multi-factor authentication, conditional access, auditing, and retention often sitting there unused. Before you spend on anything new, ask your IT provider what your licensing already entitles you to. That one question closes real gaps at minimal cost surprisingly often.
Give leadership one page
At the end of that first month, your leadership team doesn’t need a 40-page cyber security report. Instead, give them a single page with the three cyber risks that matter most right now.
For each one, explain:
What could happen
Why it matters to the organisation
What you recommend doing
Roughly what it will take
What decision or funding you need from leadership
That’s something leadership can act on, and something they can take to the board without first translating a technical security report, which is usually where these things stall.
You don't have to become the expert
Being handed responsibility for cyber security doesn’t mean you need to become a penetration tester, security architect, or incident responder.
Your job is to make sure the risks that matter are understood, that somebody competent is leading the work, that your technical providers know the priorities, and that the budget is being spent where it will make the biggest difference.
For some organisations, that leadership sits with an internal security executive. For others, a Fractional CISO (also known as a vCISO) can provide that senior security leadership without the cost of a full-time hire, working alongside your team and your existing IT provider.
Either way, the starting point is the same. Work out what you’ve got, what you’d need back and how fast, and what’s already being done. Then close the gaps that matter most. The rest can wait its turn.
If you'd like somewhere practical to start, check out our free checklist, or get in touch to have a chat about how our Fractional CISO service could help you.
