Where should you begin preparing for information security?

First, identify your critical data, the systems that hold it and who has access to it. Prioritise the risks of data loss, unauthorised access and service disruption according to their impact on your business.

In line with the ISO/IEC 27001 approach, clarify responsibilities. Turn updates, backups, access control and employee awareness into regular processes. Review the measures you have taken at defined intervals and address any gaps.