List of “low hanging fruit” security improvements

I’m trying to create a list of high-impact, but relatively easy configuration changes that improve cybersecurity in the real world for companies of all sizes.

I’ll start off with a few items I’ve observed/fixed in real life, I’d appreciate additional suggestions!

1. Turn on MFA and ensure it is *enforced* by default for all new hires.
2. Turn on conditional access or some other check to ensure only known/authorized devices are connecting.
3. Ensure there is a health/posture check for …

companies configuration configuration changes cybersecurity default easy fruit high impact life list low mfa security start turn world