Cyberattacks don’t discriminate. A local bakery and a Fortune 500 company can get hit on the same afternoon. What separates businesses that recover quickly from those that don’t almost always comes down to preparation, not budget.
On August 29, 2025, CISA (the Cybersecurity and Infrastructure Security Agency) published a focused memo outlining four core practices that any organization can act on immediately. No jargon overload, no six-figure security stack required. Just four disciplines that close the doors attackers rely on most. This article breaks down each one, explains why it works, and shows how to put it into practice, whether you run a ten-person shop or manage IT for a mid-size enterprise.
What Is CISA’s Cyber Defense Playbook?
CISA’s guidance is built around four principles: visibility, resilience, confidentiality, and collective defense.
- Logging gives you visibility into what’s happening across your systems.
- Backups give you resilience when an attack succeeds.
- Encryption protects confidential data even if it’s stolen.
- Incident reporting turns your bad day into a warning that protects other organizations.
Each practice reinforces the others. A business that logs everything but never backs up its data is still one ransomware attack away from disaster. All four working together is what actually moves the needle.
Step 1: Enable Logging on Your Systems
You cannot stop what you cannot see. Logging is the foundation of every effective security program, and it’s one of the most commonly skipped steps among small and mid-size businesses.
What to log:
- Administrator actions (who changed what, and when)
- Authentication events (successful logins, failed attempts, MFA prompts)
- Network traffic flows, especially lateral movement between internal systems
- System events on servers, endpoints, and cloud services
How to make logging useful:
Turning logging on is just the start. Raw log files sitting in a folder don’t help anyone. The goal is centralization and alerting. Feed your logs into a SIEM (Security Information and Event Management) platform, or at minimum a centralized log management tool, so you can correlate activity across systems and spot patterns a single log file would never reveal.
Set automated alerts for high-risk behaviors: repeated login failures on an admin account, a user suddenly accessing file shares they’ve never touched, a service account making outbound connections at 2 a.m.
Protect your logs, too. Attackers who compromise a system often try to delete or modify logs to cover their tracks. Restrict write access to log storage. Consider sending logs to a system the attacker can’t reach, such as an isolated SIEM instance or a write-once cloud storage bucket.
Retention matters. Most incident investigations require weeks or months of log history. Set your retention policy based on regulatory requirements and your internal incident response timeline. 90 days is a reasonable minimum; 12 months is better for regulated industries.
Finally, don’t let this become a one-person job. Assign clear roles: who monitors alerts, who investigates anomalies, who escalates to leadership or legal. A crisis team with defined responsibilities responds faster than one where everyone assumes someone else is watching.
Step 2: Back Up Your Business Data
Ransomware’s business model is simple: encrypt your data, charge you to get it back. Backups destroy that model entirely. If you can restore from a clean copy, the attacker has nothing to sell you.
Start with an inventory. Before you back up everything, identify what actually keeps your business running. Customer records, financial data, operational databases, proprietary files: prioritize those. Backing up irrelevant data wastes storage and slows restore times.
Apply the 3-2-1 rule:
- 3 copies of your critical data
- 2 different storage media (e.g., local drive + cloud)
- 1 copy stored off-site, disconnected from your primary network
The off-site, offline copy is the piece most businesses skip, and it’s the one that saves you when ransomware spreads through a network-connected backup drive.
Test your restores. A backup you’ve never tested is a backup you can’t trust. Run actual restore drills. Verify that files come back intact and that systems can be rebuilt within your acceptable recovery window. CISA recommends targeting a restore capability within seven days for most business systems; for critical operations, that window should be much shorter.
Don’t forget operational technology. If your business relies on industrial controls, manufacturing equipment, or other OT systems, document manual procedures so critical functions can continue during a system outage. A factory floor that knows how to operate without its software is far more resilient than one that grinds to a halt waiting for IT.
Make backups part of regular training. Your team should treat running and verifying backups as routine, not something they scramble to figure out mid-incident.
Step 3: Encrypt Sensitive Business Data
Encryption is your last line of defense when everything else fails. If an attacker exfiltrates your data but can’t read it, the breach is a nuisance rather than a catastrophe.
Understand the three layers of encryption:
- Full-disk encryption protects entire devices. If a laptop is stolen, the thief gets a brick. BitLocker (Windows Pro) and FileVault (macOS) handle this at the OS level. Modern smartphones encrypt by default; confirm this in your device settings.
- Drive/volume encryption secures on-premises servers and removable media like USB drives. Any device that leaves your office or holds sensitive data should have this enabled.
- File-level encryption adds protection to specific documents regardless of where they travel. Useful for files shared externally or stored in cloud environments with broad access.
What should be encrypted by default:
- Personally identifiable information (PII)
- Protected health information (PHI)
- Financial records and payment data
- Internal communications containing strategy or legal matters
- Operational and configuration data
Encrypt in transit, not just at rest. Data moving between systems, including across your network, through APIs, or to cloud services, should travel over encrypted channels (TLS 1.2 or higher). Unencrypted internal traffic is a common blind spot.
Encrypt your backups. A plaintext backup sitting on an external drive is just as exposed as the original data. Encrypt backup files and store the decryption keys separately from the backup itself.
The biggest barrier to encryption is friction. Teams disable it because it slows devices down or causes startup issues. The fix is system health: a well-maintained device with clean services and a healthy file system handles encryption with minimal performance impact. Build encryption into your device provisioning process so it’s on by default, not something added later.
Step 4: Report Cyber Incidents to CISA
Cybersecurity is not a solo sport. When one organization discovers a novel attack technique or a new vulnerability being actively exploited, that intelligence can protect hundreds of others, but only if it gets shared.
CISA’s Cyber Incident Reporting System exists for exactly this purpose. Businesses should report:
- Confirmed attacks, even if contained
- Suspected intrusions or unusual activity that could indicate compromise
- Exploitable vulnerabilities discovered in products or infrastructure
- Indicators of compromise (IOCs) such as suspicious IPs, file hashes, or domains
What to include in a report:
- A clear description of what happened and when
- Observed attacker behavior (tactics, techniques, tools)
- Business impact: systems affected, data involved, operational disruption
- Any indicators that could help others detect the same threat
Designate a single point of contact for CISA coordination before an incident happens. In a crisis, you don’t want to spend time figuring out who’s responsible for communicating with federal agencies. Early reporting benefits you directly. CISA can accelerate warnings to peer organizations in your sector, connect you with technical assistance, and share threat intelligence that speeds up your own investigation. The sooner you report, the faster that cycle runs, for you and for the organizations that might be targeted next.
How to Apply These Steps at Home
CISA’s memo targets businesses, but the logic applies just as well to individuals. The four principles, visibility, resilience, confidentiality, and community, scale down cleanly.
Visibility at home:
- Keep your OS, apps, and router firmware updated
- Enable login alerts and account activity notifications for email, banking, and social accounts
- Use multi-factor authentication on every account that offers it
- Check your router’s admin interface periodically for unfamiliar connected devices
Resilience at home:
- Apply the 3-2-1 backup rule: local copy, external drive, cloud storage
- Keep at least one copy disconnected from the internet (unplugged external drive)
- Test that you can restore a file from your backup before you ever need to
- Set a monthly calendar reminder to verify your backup is running
Confidentiality at home:
- Enable full-disk encryption on your laptop (BitLocker or FileVault) and confirm it’s active on your phone
- Use a password manager with unique, strong passwords for every account
- Avoid handling sensitive tasks on public Wi-Fi without a VPN
- Store important documents (tax returns, legal files) in an encrypted vault, not an unprotected Downloads folder
Community at home:
- Report financial fraud to your bank and card issuer immediately
- Freeze your credit with all three bureaus if your identity may be compromised
- Report phishing attempts to the service provider (most have a dedicated abuse address)
- Submit scams and cybercrime to the FTC (reportfraud.ftc.gov) or the FBI’s IC3 (ic3.gov)
How JENI Helps You Take Action
Knowing what to do and having the operational conditions to do it reliably are two different things. JENI™ bridges that gap by keeping Windows and macOS systems in the kind of clean, stable state where security practices actually stick.
Supporting logging and visibility: JENI performs regular health checks that flag services starting unexpectedly, processes consuming unusual resources, and network behaviors that stand out against a clean baseline. A system cluttered with startup conflicts and stale background processes generates noisy, unreliable log data. JENI reduces that noise so your monitoring tools surface real signals rather than false positives.
Strengthening backup reliability: Backups fail for predictable reasons: file system errors, disk fragmentation, services that conflict with backup agents, and temp files that inflate backup sizes. JENI clears the clutter, repairs file system inconsistencies, and reduces the conditions that cause backup jobs to stall or produce incomplete archives. Pair JENI with your backup tool of choice and run a health check before your scheduled backup window.
Improving encryption performance: The most common reason teams disable full-disk encryption is that it slows devices down. That slowdown is often caused by underlying system issues, not encryption itself. JENI repairs core services, clears startup conflicts, and optimizes disk health so encryption runs efficiently. Devices feel faster after a JENI maintenance pass, which means fewer complaints, fewer disabled policies, and broader encryption coverage across your fleet.
Sharpening incident reporting: When something goes wrong, you need to reconstruct a clear timeline. JENI’s maintenance logs provide before-and-after context for system state: what changed, when services shifted, what was cleaned or repaired. That documentation accelerates your internal investigation and gives you specific, useful detail to include in a CISA report or a briefing to external partners.
Key Takeaways
CISA’s four best practices are not complicated. They require consistency more than complexity.
| Practice | What It Gives You |
| Logging | Early warning before damage is done |
| Backups | A way out when an attack succeeds |
| Encryption | Protection even after data is stolen |
| Incident reporting | Defense that extends beyond your own walls |
Start with whichever step your organization is weakest on. If you have no centralized logging, start there. If your last backup restore was never tested, fix that this week. If full-disk encryption is off on even one company laptop, turn it on today. Small, consistent improvements compound. Organizations that apply all four of these disciplines don’t just recover faster from attacks; they become harder targets in the first place.
Sources: CISA Cybersecurity Best Practices for Businesses (August 29, 2025). Learn more at cisa.gov.
Keep Learning: Related Articles
Putting CISA’s four practices into action takes more than a single read. These articles go deeper on the steps covered above and are a practical next step depending on where your gaps are.
Security Logging and Alerts for Small Teams Without a SOC: Walks through how to build a functional monitoring setup without a dedicated security operations center, picking up exactly where Step 1 leaves off.
Windows PC Backup and Recovery: Covers the hands-on process of setting up and verifying backups on Windows, including how to test restores before you need them.
Ransomware Explained: Protection Tips: Breaks down how ransomware actually works and why the combination of backups and encryption is your most effective defense against it.
First 60 Minutes: Breach Containment Playbook: Tactical guide for what to do the moment something goes wrong, including how to preserve evidence for an incident report.
CISA: Stronger Cyber Defense, Faster Updates, Safer Devices: Covers additional CISA guidance on patching cadence and device hardening that pairs directly with the practices outlined here.
Small Business Cyber Control for IT Providers: Aimed at teams managing security for smaller organizations and covers the controls that matter most when resources are limited.
