--- title: "Of 10 classic security steps, 3 still hold; the missing one starts 31% of breaches" summary: "A 2022 ten-step staff security checklist re-scored against Verizon’s 2026 breach data, CIS IG1 and India’s CERT-In and DPDP duties, as of September 2026." url: https://www.thetechbag.com/blog/10-steps-safeguard-data-network-security-organization format: Note desk: "Network & SASE" published: 2024-11-26 facts_checked: 2026-09-30 author: TechBag (The TechBag Journal) tags: ["security hygiene","Verizon DBIR","patching","MFA","backup","CIS Controls","CERT-In","DPDP","SMB security"] cover: https://www.thetechbag.com/blog/covers/10-steps-safeguard-data-network-security-organization.png --- # Of 10 classic security steps, 3 still hold; the missing one starts 31% of breaches *A 2022 ten-step staff security checklist re-scored against Verizon’s 2026 breach data, CIS IG1 and India’s CERT-In and DPDP duties, as of September 2026.* Note · Network & SASE · By TechBag · Published 2024-11-26 · Facts checked 2026-09-30 · Canonical: https://www.thetechbag.com/blog/10-steps-safeguard-data-network-security-organization The short version - Breaches now begin most often at an exploited software vulnerability (31%), ahead of an abused credential (13%). None of the 2022 list’s ten steps asked anyone to patch faster.[1] [2] - Re-scored, three of the ten steps still stand as staff habits, five have become a product line with a price, and two are obsolete. - For an Indian company the list has a legal floor: CERT-In’s 2022 Directions and the DPDP Rules’ safeguards and breach duty from 13 May 2027.[5] [6] The 2022 version of this piece told staff to pick a strong password, lock the screen, shut the PC down at night, use the network drive and avoid Internet Explorer. Its question is still the right one for a 200-person Indian company without a security team: what short list of changes actually cuts the chance of a breach? The difference is that we now have data on how breaches start. ## Where breaches start, measured Verizon’s 2026 Data Breach Investigations Report, covering more than 31,000 incidents and 22,000 confirmed breaches between 1 November 2024 and 31 October 2025, found for the first time that exploiting a vulnerability (31%) had overtaken credential abuse (13%) as the way in.[1] [2] A human action figures in 62% of breaches, ransomware in 48% and a third party in 48%. Only 26% of critical known-exploited vulnerabilities were fully fixed in 2025, and the median time to fix was 43 days.[2] **Figure: Two doors open most breaches, and the 2022 checklist had no step for the bigger one** *Share of confirmed breaches, Verizon DBIR 2026 (incidents 1 November 2024 to 31 October 2025)* Began with an exploited vulnerability initial access 31% Began with credential abuse initial access 13% Human element involved 62% Ransomware involved 48% Third party involved 48% Credential abuse at any stage 39% | | Value (%) | | --- | --- | | Began with an exploited vulnerability | 31 | | Began with credential abuse | 13 | | Human element involved | 62 | | Ransomware involved | 48 | | Third party involved | 48 | | Credential abuse at any stage | 39 | Source: Verizon 2026 DBIR via Help Net Security (25 May 2026) and Descope (21 July 2026) · as of 30 September 2026 · Rows overlap. The two highlighted rows are initial-access vectors; the rest are involvement at any stage ReportedReported, Verizon DBIR 2026 73% of ransomware victims had an infostealer or credential leak in the preceding year; 37% of organisations had an infrastructure admin account with MFA disabled.[3] ## The ten steps, re-scored Read against that table, the 2022 list sorts into three piles. The counting is TechBag’s. 1. **Still a staff habit (3 of 10).** Step 2, never lending your account; step 4, locking the screen; step 8, confirming an unexpected attachment with the sender. They cost nothing, and pretexting is now tracked as an initial-access vector.[3] 2. **Now a product with a price (5 of 10).** Step 1’s strong password needs MFA or passkeys behind it, through an identity provider at US$3 to US$17 a user a month on list.[7] Step 3’s network drive is a backup with an immutable copy. Step 6’s “use HTTPS, distrust Wi-Fi” is zero-trust access. Step 7’s ban on unapproved software is application control and SaaS discovery: 45% of employees now use AI tools at work, and 67% of that access runs through personal accounts.[2] Step 9’s weekly antivirus scan is an endpoint agent, ₹1,250 to ₹5,200 a seat a year on reseller lists.[8] 3. **Obsolete (2 of 10).** Step 5, shutting the PC down at night, works against you: a laptop that is off misses the patch window. Step 10, avoiding Internet Explorer, resolved itself when Microsoft retired the desktop app on 15 June 2022.[9] The missing step is the one the data ranks first: patch every device within days of a critical fix. The modern ten-step list is CIS Controls Implementation Group 1, 56 safeguards of “essential cyber hygiene” with inventory, patching, MFA, backup and logging as the spine.[4] Our view For a company with no security team the order is patching, MFA on every admin login, an immutable backup, an endpoint agent, then email filtering. The 2022 list had the habits right and the priorities inverted. ## The legal floor in India CERT-In’s Directions of 28 April 2022 require every body corporate to synchronise clocks to the NIC or NPL time source, report a listed incident within 6 hours, and keep logs of all ICT systems for 180 days within Indian jurisdiction.[5] The DPDP Rules, notified on 13 November 2025, bring reasonable security safeguards and breach intimation, with a detailed report to the Board within 72 hours, into force on 13 May 2027.[6] The Act sets penalties of up to ₹250 crore for failed safeguards and ₹200 crore for an unreported breach.[10] Every licence above is a USD list price, invoiced in INR through a reseller with 18% GST; the 180 days of logs is a storage tier, and it is the item the regulator will ask to see. How we did this Figures as of 30 September 2026 Breach shares are Verizon’s 2026 DBIR as stated on its report page and in two dated secondary accounts; the PDF was not read. The re-scoring of the ten steps is TechBag’s judgement. Price bands come from TechBag’s own sourced pieces on identity and endpoint pricing and are list prices, not quotes. The CIS safeguard count is CIS’s own. Spotted an error? Write to us; corrections are published at the foot of the piece. Sources 1. [Verizon, 2026 Data Breach Investigations Report (report page; incidents 1 November 2024 to 31 October 2025)](https://www.verizon.com/business/resources/reports/dbir/) — May 2026 2. [Help Net Security, Lessons for organizations from the Verizon 2026 DBIR (31,000 incidents, 22,000 breaches; 31%, 13%, 62%, 48%, 48%, 26%, 43 days; 45% and 67% AI figures)](https://www.helpnetsecurity.com/2026/05/25/lessons-from-verizon-dbir-2026-findings/) — 25 May 2026 3. [Descope, summary of the Verizon 2026 DBIR (39% credentials at any stage; 73% infostealer link; 37% admin without MFA; pretexting newly tracked)](https://www.descope.com/blog/post/verizon-dbir-2026) — 21 July 2026 4. [Center for Internet Security, CIS Controls Implementation Group 1 (56 Safeguards)](https://www.cisecurity.org/controls/implementation-groups/ig1) — undated page 5. [CERT-In, Directions under section 70B(6) of the IT Act, 2000 (clock sync; 6-hour reporting; 180 days of logs within Indian jurisdiction)](https://www.cert-in.org.in/PDF/CERT-In_Directions_70B_28.04.2022.pdf) — 28 April 2022 6. [Digital Personal Data Protection Rules, 2025: phased commencement (Rules 6 and 7 from 13 May 2027; 72-hour report to the Board)](https://legismith.com/dpdp-rules-2025-timeline/) — notified 13 November 2025 7. [TechBag, IAM costs $3 to $17 a user a month (six vendors' list prices)](https://www.thetechbag.com/blog/iam-where-indian-companies-get-it-wrong) — facts checked September 2026 8. [TechBag, Seqrite at ₹1,250 vs Kaspersky at ₹5,200 (reseller INR lists per seat per year)](https://www.thetechbag.com/blog/seqrite-vs-kaspersky-endpoint-india) — facts checked September 2026 9. [Microsoft, Internet Explorer 11 desktop app retirement](https://learn.microsoft.com/en-us/lifecycle/announcements/internet-explorer-11-end-of-support) — 15 June 2022 10. [Digital Personal Data Protection Act, 2023, Schedule (penalties)](https://www.meity.gov.in/data-protection-framework) — 11 August 2023 **Disclosure.** TechBag is a software reseller: it earns a margin when a reader buys through it, including from vendors named here. The analysis is TechBag’s own; no vendor paid for or saw this piece before publication. Facts are labelled reported, TechBag count or our view. Go deeper on TechBag - [Firewall & network security guide](https://www.thetechbag.com/browse/network-security-sase/firewall-network-security) — the perimeter products the 2022 list assumed - [IAM, SSO and MFA guide](https://www.thetechbag.com/browse/identity-access/iam-sso-mfa) — the MFA and passkey products that replace step 1's password - [Backup & recovery guide](https://www.thetechbag.com/browse/backup-cyber-resilience/backup-recovery) — the immutable copy that replaces step 3's network drive