By Cyber Defense Technologies October 31, 2026 4 min read
Cybersecurity Awareness Month closes today. Over the past weeks this series has covered a wide range of topics: passwords and MFA, asset inventory, email authentication, vendor risk, privileged access, segmentation, endpoint detection, patching, secrets, APIs, DNS and disclosure programs, among others.
None of these is a one-time project. Configurations drift, staff change, new systems appear and attackers adapt. The organizations that stay resilient are the ones that turn good intentions into routines with owners and dates.
From a month to a rhythm
Start by writing down a security calendar. For each recurring task, record what it is, who owns it, how often it happens and where the result is reported. A simple shared calendar or tracker is enough. The aim is to make security work visible and predictable, so it is not crowded out by whatever is urgent this week.
Keep the calendar realistic. A short list of tasks that actually happen is worth more than an ambitious plan abandoned within a few months. Smaller organizations can combine tasks or hand routine checks to a trusted provider.
NIST CSF 2.0 is a useful way to check balance. Its six functions, Govern, Identify, Protect, Detect, Respond and Recover, help confirm the calendar does not focus only on prevention.
Every month
- Patching: confirm the routine cycle completed, and review overdue items and exceptions.
- Exploited vulnerabilities: check new additions to CISA's Known Exploited Vulnerabilities catalog against your inventory.
- Accounts: remove access for people who have left, and review new privileged accounts.
- Alerts and logs: confirm critical systems are still sending logs and that alert queues are being worked.
Every quarter
- Access reviews for privileged accounts, remote access and sensitive data.
- Asset inventory reconciliation, including cloud resources, office devices and anything found by discovery scans.
- External exposure review of internet-facing services, DNS records, domains and certificates.
- Restore tests for a rotating selection of critical systems.
- Vendor review of suppliers with access to your systems or data.
Every year
- Review and update the incident response plan, contact lists and communication templates.
- Commission independent testing, such as a penetration test or red team exercise, scoped to current risks.
- Reassess compliance obligations and the evidence needed to show them, such as NIST SP 800-171 requirements for contractors handling CUI.
- Confirm that the people responsible understand contractual and regulatory incident reporting obligations, and that cyber insurance requirements are still being met.
- Revisit the risk assessment with leadership and agree on priorities and budget for the coming year.
Exercise on a schedule
Plans that are never practiced tend to fail in small, avoidable ways: an outdated phone number, an unclear decision owner, a backup no one has restored. Schedule tabletop exercises at least once or twice a year, varying the scenario, such as ransomware, business email compromise, a supplier breach or a leaked credential. Include leadership, legal, communications and contracts staff, not only IT. Record the actions that come out of each exercise and track them like any other finding.
Measure what improves
A short set of outcome-focused metrics keeps the rhythm honest. Useful examples include the time to remediate known exploited vulnerabilities, MFA coverage for privileged and remote access, the proportion of assets covered by EDR and central logging, restore test results and exercise actions closed on time. Report trends to leadership each quarter, along with the decisions or resources that would move them.
Keep training continuous
Awareness is not a once-a-year event. Short, regular sessions tied to current threats work better than a single annual module. Make reporting suspicious messages and calls easy, and acknowledge people who do it. Give technical staff role-specific training, such as secure coding for developers and cloud security for administrators, and refresh it as tools change. The topics covered this month make a ready-made list for those sessions, one short theme at a time.
How CDT can help
CDT works with organizations year-round, not just in October. Our control assessments establish where you stand and what to prioritize, our training keeps staff and technical teams current, and our managed security team can carry many of these recurring tasks for you.
