Take the inventory from Part 1 and open the settings for each account or device. Verify what is enabled. Turn anything that cannot be confirmed into an assigned next action.
This article is based on the final NIST CSWP 50, published on November 2, 2026, mainly pages 2 and 14–18. The sequence, record and completion criteria below are the author's adaptations, not a NIST certification process. An expensive tool suite is not a prerequisite. If a service lacks a setting, document the limitation and assess alternatives.
1. Check accounts that control other business activities
Start with email, banking or payment accounts, sensitive file storage, the password manager and critical cloud services. Include backup accounts. NIST recommends MFA on every account that offers it, especially sensitive or privileged accounts, with preference for phishing-resistant methods. Pages 2 and 15
For each account:
- Open its security settings through a verified service entry point. Check the current authentication method and available options.
- Enable the MFA the service offers. Prefer a phishing-resistant option when available. The publication describes common passkeys used with another factor such as a PIN or fingerprint.
- Verify recovery contacts and the provider's recovery process. Record the entry point or controlled storage location, without putting passwords, tokens or recovery codes in the ordinary inventory.
- Where passwords remain in use, use strong, distinct passwords or passphrases. A password manager can generate and store them.
Page 2 recommends passwords of at least 15 characters. This is the publication's advice, not a universal product compliance threshold. Passkeys and MFA do not guarantee that an account cannot be stolen. The publication notes that some MFA methods remain susceptible to phishing; an ordinary verification code should not be described as phishing-resistant authentication.
If settings or recovery options cannot be confirmed, keep the question open and seek help through a verified service entry point or provider support. If anomalies have occurred or account theft is suspected, use Part 3's incident steps. Do not continue recovery through a suspected compromised device or account.
2. Reduce everyday privileges and external access
NIST recommends a standard user account for routine work instead of continuous use of an administrator account. Family members using a shared device should have separate accounts without access to sensitive business data. Limit third-party access to the tasks and duration needed, and review it periodically. Page 14
Check device accounts and cloud-service members against the inventory: who still uses them, whether their permissions are needed, and when the task ends. Remove access that is no longer required after an engagement ends. The standard-account recommendation does not mean blindly deleting the only administrator or an unverified recovery route.
If a delivery requires a shared device, document the boundary between personal and business accounts. Keep any separation that cannot be achieved as a known risk rather than marking least privilege complete.
3. Check default passwords, updates and support
Review each device in the inventory, including routers, printers and other connected equipment:
- Replace manufacturer default passwords still in use and record which devices were checked, without recording the new secrets.
- Install available operating-system and application updates; enable automatic updates where appropriate.
- Confirm end-of-support status with providers and arrange replacement of products or services that no longer receive security updates.
- Maintain suitable security software and check that its updates and detection are operating.
Page 14 recommends checking for available updates at least monthly, and security awareness training at least once a year. Page 17 also recommends scheduled update checks and installation as soon as feasible. The monthly check is therefore a minimum routine-review recommendation, not a reason to postpone an identified security patch until next month. Pages 14 and 17
A completed review should identify supported devices, installed updates and outstanding limitations separately. One green status cannot represent all three.
4. Verify payment, invoice and account changes separately
Pause before acting on urgent payment requests, changes to bank details or invoices, or instructions to log in. Verify them through contact details that were already known and trusted. Do not verify by using the telephone number or link in the suspicious message. Checking the actual sender address helps, but the display name alone is not a verdict. Page 16
This adapted verification record can be used:
Requested change: ____
Existing trusted channel used to verify: ____
Person contacted and result: ____
Verification time and next action: ____Keep an unverified request pending, even if the sender is pressing for action. This procedure helps examine requests; it does not identify every scam. Move to incident response if unauthorized action has already occurred.
5. Make anomalies visible and assign an alert destination
Where supported, enable logs and notifications for new logins, password resets, banking or payment transactions and domain-record changes. Confirm where notices arrive and how a suspicious event leads into the response plan. NIST presents these as starting detection measures, not a requirement to build a round-the-clock monitoring center. Page 18
Include the physical workplace. At home, in a café or in shared offices, check screen locks, device storage and the tracking or remote-wipe capabilities actually offered by devices. This article does not assume that all devices have those capabilities or provide a universal wipe command.
Leave a record that can be reviewed
| Area | Current state and evidence | Outstanding issue and next action |
|---|---|---|
| Authentication and recovery for critical accounts | Verified settings and entry points | Support limitations or questions |
| Device and third-party access | Actual users and required permissions | Access to remove or reduce |
| Defaults, updates and support | Check date and support status | Why an update remains outstanding and what to do |
| Alerts and verification | Notification channel and plan location | Unconfirmed notifications or contacts |
The completion criteria are this article's own: critical accounts have an explainable authentication and recovery state; devices and users match the inventory; outstanding updates have next actions; and alerts have a destination. Record the review date and revisit the record as the business changes. This is not a compliance certificate or a guarantee against incidents.
Return to Part 1: assets and risks for dependencies and responsibilities, then prepare Part 3: backups, planning and recovery.