Your 30-day cybersecurity action plan

Learning edition: 5 October 2026. Practical application exercise.

Allow 30–45 minutes. Build a first plan for one business process. Use an invented example or an authorized internal record. Keep actual vulnerabilities, contacts and business information in your organization's approved location.

1. Define the business need

• Process and business owner:
• Systems, information and key suppliers, including AI tools and connected apps:
• Consequences of unavailable, altered or exposed information:
• Acceptable downtime and data loss, to be agreed with the owner:
• Incident reporting route and backup contact:

2. Choose three improvements

For each action, copy and complete this record:

• Finding and evidence: What is known, and what still needs verification?
• Priority and reason: Explain the business impact and exposure. Escalate an active incident immediately through the response process.
• Action and scope: What will change? Identify required authorization and technical support.
• Owner, target date and resources: Name the accountable role and dependencies.
• Acceptance evidence: What observable result will show the action worked?
• Status and remaining risk: Record the result, unresolved questions and who accepts any remaining risk.

Worked example

Finding: The business email administrator confirms that one privileged account lacks enforced MFA. Action: The identity administrator will pilot an approved phishing-resistant method and recovery procedure. Owner: IT lead. Target: A date agreed within the first week. Evidence: Approved sign-in and recovery tests, enforcement confirmation and an exception decision if the provider cannot support the preferred method. Do not include credentials or recovery codes in the plan.

3. Sequence and review

• Days 1–7: Confirm owners, evidence and urgent priorities. Agree the authorized work with your providers.
• Days 8–21: Carry out agreed changes, brief affected people and record test results.
• Days 22–30: Review acceptance evidence, resolve gaps and set the next review date.

This is a planning pattern, not a reason to delay urgent incident response or a guarantee that every improvement will fit within 30 days.

Completion rubric

Your draft is ready for an internal review when all five criteria are met:

1. A critical process, owner and consequences are clear.
2. Three actions are prioritized using stated evidence.
3. Each action has an owner, date and required authorization.
4. Acceptance evidence includes a practical check of the intended result.
5. Incident contacts, unresolved questions and the next review are recorded.

Ask the responsible business and technical owners to review the plan. Record feedback and decisions. This course does not automatically assess or approve your plan. Continue reviewing after incidents, exercises, or significant system and supplier changes.

Reference: NIST small-business cybersecurity framework resources.

Add one AI-related decision

If your process uses AI, review the tool’s owner, approved data, connected apps, permitted actions and reporting route. If it does not, record how staff will request approval before introducing one.

Example action: Before piloting an assistant for supplier summaries, the business owner and IT lead will agree a limited document set and draft-only workflow. Acceptance evidence: a fictional-document trial, confirmation of the actual access granted, a documented review of proposed output, and a tested way to disable the connection. Record remaining risks. Add this to your three priorities if warranted, or explain why another issue comes first.