Security Controls That Actually Protect a Small Team

A small team's security program, sorted by what limits damage fastest: identity, tested backups, patch cadence, email hardening and access review.