A 15-Minute Digital Security Checklist: Passwords, MFA, Updates, Phishing

Do these in order

1. Passwords (5 minutes). CISA says make them at least 16 characters, random and unique for each account. Use a password manager so you do not have to remember them. Start with email and banking.

2. Multi-factor authentication (5 minutes). Turn on MFA for every account that offers it. CISA says that even if a password is stolen, the thief cannot meet the second-step requirement. An authenticator app generates a new code every 30 seconds.

3. Updates (2 minutes). CISA says many updates fix security risks, so install them promptly and turn on automatic updates. The FTC also advises setting security software to update automatically on computers and phones.

4. Phishing awareness (1 minute). Do not click links or open attachments in unexpected messages. CISA says to delete them, or contact the sender another way using details you know are real.

5. Back up (2 minutes to schedule). The FTC says back up the data on your computer to an external hard drive or in the cloud, and back up your phone too.

Why this order

The FTC describes four ways to protect yourself from phishing: security software, automatic phone updates, multi-factor authentication and backups. The first three also guard against other threats, so they are a good base.

Next steps

Read our separate guides on passwords, MFA, phishing and updates for details.

Fact-checked on 30 October 2026 against the sources listed below. Prices and plans change, so confirm with the provider before you buy.