Cyber Security 201: From Personal Habits to Organisational Discipline

The first course gave you a list: enable two-factor, update your devices, take a backup. That list is enough for a business run by one or two people.

Then the business grows, and the list expires.

When the list expires

Five signs that you have outgrown the do-it-yourself level:

1. You have employees — and security now depends on the behaviour of people you do not watch all day.

2. A system or two has arrived — point of sale, accounts, stock, and perhaps links between them.

3. You have suppliers reaching your data — an accountant, a marketing agency, a developer.

4. You now have something real to lose — years of data, and customers who depend on you.

5. Your customers have started asking — a larger company wants answers about how you protect its data.

At this point the list becomes inadequate, because it answers "what do I do?" and not the question you now face: "what is worth my effort specifically?"

The difference between 101 and 201 in one sentence

101 gives you what to do. 201 gives you how to decide what to do — and then how to make it outlast you.

The first is about measures; the second about method and discipline: risk assessment, threat modelling, roles instead of people, detection instead of prevention alone, and evidence instead of assertion.

Is this course for you? An honest test

I will say it plainly because I do not want you paying for something that does not suit you yet:

If you have not completed the 101 basics — two-factor on your accounts, a password manager, updates, and a backup whose restore you have tested — stop here and do those first.

This is not marketing for the other course. It is that 201 assumes those basics and does not repeat them, and building governance on accounts without two-factor is building a second floor on an incomplete foundation.

And if you have done them, you are in the right place, and the rest builds on them.

From an inventory to a risk register

In 101 you built an asset inventory: what I own. Here we take the next step: what might happen to each of them, and how much I care.

The risk register is one table, and it is the central document of this course:

Likelihood and impact: each from 1 to 5. And score = their product (1 to 25).

How to estimate likelihood without guessing

There are no statistics for your particular business. But three questions give you a reasonable estimate:

1. Has it happened to me or to someone I know in my field? Prior occurrence is the strongest indicator available.

2. How easy is it? What does someone need to do it — a minute or a week?

3. How many people could do it? Your five employees, or anyone on the internet?

And the practical rule: estimate with reasonable confidence and move on. A risk register with approximate estimates is far more useful than a perfect one never written.

Impact: compute it in money and time

Impact is not a feeling. Ask of every risk:

• How many hours of downtime? × what you earn per hour
• What does the repair cost?
• How many customers might I lose?
• Does it stop the business entirely or partly?

An example: the point of sale down for a full day on a busy day — calculate that day's sales, and that is the impact in numbers. And one number persuades you to spend on prevention more than ten pages of advice.

Four decisions per risk

Once you know the score, you have four options — and this is the point missed by everyone who assumes security means addressing everything:

1. Reduce — a measure that lowers the likelihood or the impact. This is most of what you will do.

2. Transfer — insurance, or a supplier taking on part of it by contract.

3. Avoid — stop the activity that creates the risk at all.

4. Accept — an entirely legitimate decision for a low-scoring risk, or one whose treatment costs more than its impact.

And conscious acceptance is far better than unconscious neglect. The difference is that you write it: "we accepted this risk because... and we will review it on...". A written, dated decision rather than neglect.

Prioritising

Sort your register by score descending, then work from the top — and start within each level with the cheapest to carry out.

A risk scoring 20 that is addressed by a free measure gets done before a risk scoring 25 that needs a month and a budget.

This is not evasion — it is that the cumulative effect of quick measures exceeds waiting for the big project.

Review: what keeps it alive

A risk register written once and forgotten is worthless.

• Quarterly: review the scores, close what has been addressed, add what is new
• On any change: a new system, a new employee, a new service, a new branch
• After any incident: add it, and add what you learned from it

Action steps

1. Confirm you have completed the 101 basics — and if not, complete them before continuing.
2. Create a "risk register" file with the eight columns.
3. Write ten real risks for your business — not generic ones.
4. Estimate likelihood and impact for each (1–5) and compute the score.
5. Compute the financial impact of your top three risks in numbers.
6. Choose a decision per risk: reduce/transfer/avoid/accept — and write the reason for any acceptance.
7. Name an owner and a review date for every entry.
8. Put a quarterly review in your calendar now.