Start with the basics. The NCSC’s Critical Controls are a good set of rules to follow first, covering things like patching, MFA and backups. From there, we work you toward SMB1001 Bronze, then Silver and Gold. You don’t need to do everything at once. We start with the controls that reduce your risk the most.