Creating a sound cybersecurity plan means anticipating likely scenarios that might lead to a breach, and then building a strong defense. It can be complicated, nuanced, and a huge challenge — especially since cybercrime accounted for as much as $2.7 billion in financial losses in 2018. With tech that’s ever-evolving and hackers who will increasingly exploit any vulnerability, (including the office printer), the pressure to stay one step ahead can be enormous.

Most cybersecurity plans begin with the basics — firewalls, intrusion detection systems, incident management protocols, and spam filters — but a truly well-constructed cybersecurity defense is in the details and sometimes-overlooked assets. As you outline your cybersecurity plan, here are some additional steps to further strengthen your security controls.

Add Multi-Factor Authentication

This security protocol requires that users not only submit a password but also input a second (and sometimes third) verification of identity. This can include a biometric such as a fingerprint, text code, token, or answering secret questions. It’s growing in popularity not only for IT departments but also for B2C apps like banks and accounting software.

More layers in your authentication process mean more walls a hacker will have to break through to get to your sensitive data. It’s especially beneficial if an employee’s laptop or phone is lost or stolen.

Conducting Vulnerability Assessments

Taking an ostrich, head-in-the-sand, approach with your cybersecurity weaknesses is just what hackers are hoping for. Scanning your company’s security framework for vulnerabilities is one way to spot potential weak spots and strengthen them before they’re exploited. Tests can be performed on your entire system, including wireless, servers and desktops, databases and apps. The results of these assessments arm you with the knowledge of your system’s weaknesses enabling you to take corrective action.

Penetration Testing

The more comprehensive version of testing your organization’s weak spots is to hire a professional organization to try and gain access to your sensitive data and enterprise controls. This is called penetration testing and it involves an actual (simulated) hack on your system, the results of which can then be used to make corrections.

Building a Recovery Plan

If your data is corrupted or destroyed, either through a cyber attack or physical failure, do you have a plan in place to get it back? Recovering lost, corrupted, or accidentally deleted data can be a complicated process that involves piecing fragments back together, but with a solid backup system in place from the start, the chances or getting the data back are much higher.

Watch for Aging Hardware and Infrastructure

This issue is akin to a cell phone that might still work, but won’t support some apps or updates because it’s too many generations behind. An out-of-date operating system or infrastructure equals simpler, less-advanced technology that’s an easy target for hackers. Staying on top of the latest infrastructure has a price tag, but it’s important to weigh the cost of upgrading against the assessed likelihood of a breach and its cost.

Human Error/Risk

You can have the strongest cybersecurity plan on the planet, but if it doesn’t cover your weakest link — the humans who use it — you’re still vulnerable. And it can come from an employee accidentally deleting an entire server, to a lack of training on how to spot and report phishing scams to privilege abuse of sensitive data. Successfully implementing a human-risk deterrent requires a mix of employee cybersecurity training, access restrictions and monitoring.