Which cybersecurity controls does a business actually need? In this guide, Remesh Ramachandran lays out 22 essential cybersecurity controls, from asset inventory and access control to incident response and AI security, as a practical checklist for uncovering gaps and protecting business-critical assets.

If a cyberattack hit your business today, how quickly would you detect it?

Could you stop it before critical operations were disrupted?

A forgotten account, an unpatched system, or an unprotected AI tool can give attackers an opening. Strong cybersecurity depends on knowing your weaknesses, controlling access, and being ready to respond and recover.

These 22 essential cybersecurity controls provide a practical starting point to uncover security gaps, protect business-critical assets, and strengthen your defences. They are grouped into six areas so you can work through them with your team, but every control stands on its own.

Controls 1 to 4

Know what you are protecting

You cannot defend what you have not counted. The first four controls build the picture everything else depends on.

  1. 1
    Asset Inventory

    Maintain an updated register of devices, servers, network equipment, and cloud resources. Record ownership, business purpose, and security status to identify unmanaged assets.

  2. 2
    Software Inventory

    Track applications, versions, licences, and support status. Remove unauthorised software and replace unsupported applications that no longer receive security updates.

  3. 3
    Data Protection

    Identify and classify sensitive information. Apply encryption, access restrictions, retention rules, and secure disposal to protect data throughout its lifecycle.

  4. 4
    Secure Configuration

    Harden systems before deployment. Change default credentials, disable unnecessary services, and regularly check configurations against approved security baselines.

Controls 5 to 7

Control who gets in

Most breaches begin with an identity, not a vulnerability. Accounts, permissions and authentication decide how far an attacker can get.

  1. 5
    Account Management

    Manage accounts from creation to removal. Review inactive identities and promptly disable accounts when employees or contractors leave the organisation.

  2. 6
    Access Control

    Give users only the permissions their responsibilities require. Review access regularly, separate administrative accounts, and remove privileges that are no longer necessary.

  3. 7
    Strong Authentication

    Prioritise phishing-resistant multifactor authentication, such as security keys or passkeys. Protect email, remote access, administrator accounts, and account recovery processes.

Controls 8 to 11

Find weaknesses before attackers do

Patching, logging, endpoint protection and filtering close the everyday openings that most attacks rely on.

  1. 8
    Vulnerability Management

    Identify weaknesses and prioritise remediation using business impact, exposure, and exploitation activity. Verify fixes and track unresolved vulnerabilities through to closure.

  2. 9
    Audit Log Management

    Collect relevant logs from systems, applications, and cloud services. Protect records against tampering and establish clear investigation, retention, and escalation requirements.

  3. 10
    Malware Defences

    Deploy endpoint protection and detection tools. Monitor their health, investigate suspicious behaviour, and establish procedures for isolating compromised devices.

  4. 11
    Email and Web Security

    Filter malicious attachments, links, and websites. Configure email authentication and independently verify unusual payment requests or changes to supplier banking details.

Controls 12 to 14

Withstand and recover

When something does get through, backups, a well-built network and watchful monitoring keep the damage contained.

  1. 12
    Backup and Recovery

    Maintain protected backups, including offline or appropriately configured immutable copies. Test restoration and confirm that critical services can recover within business requirements.

  2. 13
    Network Infrastructure

    Secure routers, switches, firewalls, and wireless equipment. Restrict administrative access, update firmware, and separate business systems, guest networks, and operational technology where appropriate.

  3. 14
    Network Monitoring

    Monitor traffic for suspicious connections, unexpected data transfers, and movement between systems. Establish normal activity patterns and investigate significant alerts promptly.

Controls 15 to 17

People, partners and code

Your exposure extends to everyone who touches your systems: staff, suppliers and the software you build.

  1. 15
    Security Awareness

    Train employees to recognise phishing, social engineering, and unsafe data handling. Provide simple reporting channels and encourage early reporting without blame.

  2. 16
    Third-Party Security

    Assess suppliers according to their access and business importance. Define security responsibilities, review supporting evidence, and remove unnecessary access when contracts end.

  3. 17
    Application Security

    Integrate security into development and maintenance. Review code, scan dependencies, protect secrets, and test authentication, authorisation, and customer data separation.

Controls 18 to 22

Prove that it works

Plans, tests, leadership attention, key handling and AI guardrails turn a set of tools into a programme that holds up under pressure.

  1. 18
    Incident Response

    Prepare response procedures with named decision-makers and escalation routes. Practise containment, evidence preservation, communication, and recovery with technical and business teams.

  2. 19
    Penetration Testing

    Conduct authorised testing to assess realistic attack paths. Define scope, document findings, assign remediation owners, and retest fixes before closing weaknesses.

  3. 20
    Governance and Risk

    Establish security policies, ownership, and risk priorities. Leadership should review business exposure, provide resources, and monitor whether controls achieve their intended outcomes.

  4. 21
    Cryptographic Key Management

    Protect encryption keys throughout creation, storage, use, rotation, and retirement. Restrict access and test recovery procedures so encrypted information remains secure and recoverable.

  5. 22
    AI Security

    Approve AI tools, restrict sensitive data sharing, and test for prompt injection and information leakage. Limit agent permissions and require human approval for high-impact actions.

Put the list to work

Review these controls with your team. Identify your most critical gaps, assign owners, and set deadlines.

The real test is whether your controls work when your business needs them most.

Need a second pair of eyes? Book a session