What goes into a cyber defence plan?
A working cyber defence plan answers four questions in order: what do we have, what would genuinely hurt if we lost it, which controls reduce that specific risk, and who does what when something goes wrong. Everything else — tooling, budget, roadmap — falls out of those answers rather than driving them.
Why most plans fail
Plans usually fail for one of two reasons. Either they are a tool inventory dressed up as a strategy, or they are a compliance artefact written to pass an audit and never opened again. Both produce documents that look complete and change nothing.
The test is simple: if your plan cannot tell you what to do in the first hour of a real incident, it is not a plan.
Step 1: Inventory what you actually have
You cannot defend an asset you do not know exists. Cover internet-facing systems first — VPN concentrators, remote access gateways, public applications, management interfaces — because that is where breaches now start. Cisco Talos’ Q1 2026 incident response data found exposed infrastructure such as open management ports contributing to 25% of engagements.
Include SaaS. Most organisations underestimate their SaaS footprint by a wide margin, and the admin panel of a forgotten tool is a real entry point.
Step 2: Decide what would actually hurt
Rank systems by business consequence, not by technical interest. If this system were unavailable for three days, what stops? If this data were published tomorrow, what does it cost us in contracts, regulatory exposure and trust? That ranking is what makes later trade-offs defensible.
Step 3: Map controls to a recognised framework
Do not invent your own control set. The NIST Cybersecurity Framework gives you the functions — govern, identify, protect, detect, respond, recover — and the CIS Critical Security Controls give you a prioritised implementation order. Using an established framework also means your evidence maps cleanly to ISO 27001 or SOC 2 later, instead of being rebuilt.
Step 4: Close the identity gaps first
Identity is where the highest-value fixes cluster. Talos found MFA gaps contributing to 35% of engagements. Practical priorities: phishing-resistant MFA for administrators, removal of legacy authentication protocols that bypass conditional access, review of device registration, and elimination of standing privileged access in favour of just-in-time elevation.
Step 5: Make detection possible before buying detection
Talos found insufficient logging hampered 18% of investigations. Before investing in a detection platform, confirm you are actually retaining authentication logs, cloud control-plane logs, endpoint telemetry and network flow data for long enough to investigate. A detection tool fed by nothing detects nothing.
Step 6: Write the response plan and rehearse it
The plan needs names, not roles in the abstract. Who declares an incident. Who can authorise taking production offline. Who contacts the insurer, the regulator, affected customers. Who talks to press. Then run a tabletop exercise, because the gap between a written plan and a rehearsed one shows up entirely under pressure.
Step 7: Review on a schedule, not on an incident
Set a quarterly review with a short agenda: what changed in the estate, what did we learn from near-misses, which controls drifted. Annual reviews tend to be rewrites; quarterly reviews are maintenance.
A realistic 90-day version
If you are starting from nothing, sequence it like this. Weeks 1 to 4: inventory internet-facing assets and SaaS, and confirm what you are logging. Weeks 5 to 8: phishing-resistant MFA for privileged accounts, remove legacy authentication, patch the edge. Weeks 9 to 12: write the incident response plan, run one tabletop, and test a restore from backup.
That will not make you comprehensively secure. It will remove the failure modes that account for most real incidents, which is a better use of a first quarter than a complete framework nobody implements.
Where Rivo fits
Our cybersecurity services follow this shape: threat surface mapping, then Zero-Trust implementation, then GRC alignment to ISO 27001, SOC 2 and GDPR. Where the estate is cloud-based, our cloud services team handles governance and identity in the same engagement. Talk to our engineers about where to start.
