Resources
Practical guidance from our security team
ACS Cyber Resources is a free library of plain-English cybersecurity guides for business leaders and IT teams at small and midsize organizations. Each guide focuses on decisions you can act on, from responding to Business Email Compromise to preparing for a cyber-insurance renewal.
Have you been compromised?
If ransomware, phishing, Business Email Compromise or a data breach has already hit your organization, do not wait on a guide. Call our 24/7 incident line. We contain the threat, find out what happened, work with your insurer and counsel, help you restore operations and prevent a repeat. Not a client? Call anyway.
Browse by topic
Find guidance by topic
Start with the area that matters most to your organization right now.
Security Advisories
Notes on threats and vulnerabilities that affect common business systems, with the practical steps to take.
Incident Response Guidance
What to do when something goes wrong, from the first call through recovery and the lessons that follow.
Microsoft 365 Security
Configuration guidance for the identity, email, sharing and device settings your team relies on every day.
Cyber-Insurance Readiness
The controls underwriters commonly ask about, and how to answer applications accurately with evidence to back them up.
Compliance Guidance
Readiness guidance for regulations and frameworks such as the HIPAA Security Rule, PCI DSS, SOC 2, CMMC and NIST CSF 2.0.
Ransomware Preparedness
Backups, recovery planning and the layered controls that limit how far ransomware can reach.
Business Email Compromise Prevention
How payment fraud and mailbox takeover happen, and the verification habits and controls that stop them.
Executive Cybersecurity Education
Security concepts explained for owners, executives and boards who need to make informed decisions.
Latest
Latest guides
Recent articles from our team, newest first.
A Microsoft 365 security baseline for small and midsize organizations
The Microsoft 365 security settings we review most often, from MFA and Conditional Access to admin roles, email authentication, sharing and backup, plus what to do if an account is already compromised.
Executive Cybersecurity Education
EDR vs. MDR: what each one does and which your organization needs
EDR is a technology and MDR is a service; this guide explains what each one does, where EDR alone falls short and how to decide which fits your organization.
Cyber-insurance readiness: the controls underwriters commonly ask about
The security controls cyber-insurance applications commonly ask about, how to answer accurately, the evidence worth keeping, and how to work with your insurer if an incident happens.
Business Email Compromise Prevention
Suspected Business Email Compromise? What to do in the first hour
A calm, practical checklist for the first hour after you suspect Business Email Compromise: protect the money, contain the mailbox, preserve the evidence and report it.
Already dealing with an incident?
Help for organizations that were just hacked
These pages explain what to do now, how we contain the threat and find out what happened, and how we help you prevent a repeat.
Business Email Compromise and wire fraud
Fraudulent payment requests or changed bank details sent from a trusted account.
Phishing and hacked email or Microsoft 365 accounts
Unfamiliar sign-ins, new inbox rules or MFA prompts nobody requested.
Data breach and exposure
Records or files that may have been accessed, shared or taken.
Step-by-step first actions
What to do, in order, from containment to calling your insurer.
Not sure it is an incident?
Warning signs by area, and a self-check you can run today.
Quick answers
Common cybersecurity questions
Isolate affected devices from the network without wiping or powering them off, keep the ransom note and other evidence in place, and call an incident response team before restoring anything. Then notify your cyber insurer and legal counsel, and consider reporting the attack to the FBI’s IC3 or to CISA.
Our ransomware response page explains how we contain the attack, investigate and help you recover. Our 24/7 incident line is 1-650-300-7557.
If money may have moved, call your bank’s fraud department first. Then reset the password from a trusted device, sign the account out of every session, check for MFA methods you did not add, and document any suspicious inbox rules before disabling them.
Our guide to the first hour of a suspected BEC incident walks through each step, and our Business Email Compromise response page explains how we help.
EDR is software that detects and helps stop threats on laptops, desktops and servers. MDR is a service in which security analysts use tools such as EDR to monitor, investigate and respond around the clock. Read EDR vs. MDR for a side-by-side comparison.
Applications commonly ask about multifactor authentication, endpoint detection and response with monitoring, tested backups with offline or immutable copies, email security, privileged access, patching, security awareness training and a tested incident response plan. Our cyber-insurance readiness guide explains each one and the evidence worth keeping.
At minimum, it should include MFA for every user, phishing-resistant sign-in for administrators, blocked legacy authentication, a small number of separate admin accounts, audit logging, blocked automatic external forwarding, and SPF, DKIM and DMARC. Our Microsoft 365 security baseline covers these and more.
How we write
Guidance you can act on
Our guides draw on the work our team does every day: monitoring, investigating incidents and helping organizations strengthen their controls. They are written for the people who make decisions and the people who carry them out. Atlantic Computer Systems, our parent company, also publishes cybersecurity guides, HIPAA compliance resources and managed IT guides.
01
Plain English first
We explain what a control does and why it matters before getting into configuration detail, so executives and technical staff can work from the same page.
02
Practical, not theoretical
Each guide ends in steps you can take, questions you can ask, or evidence you can collect. If something depends on your licensing or environment, we say so.
03
Honest about limits
No single control prevents every attack, and no guide replaces advice tailored to your environment. We describe trade-offs rather than promise outcomes.
04
Connected to next steps
When a topic calls for hands-on help, we link to the related service, from managed detection and response to risk and compliance readiness.
Talk it through
Have a question a guide does not answer?
Book a free 30-minute consultation with our security team. We will listen to what you are working on and suggest a practical next step.