What is Cyber Hygiene?

Cyber Hygiene Definition

Cyber hygiene is a collection of fundamental security practices, habits, and behaviors that users and organizations should regularly follow to protect IT systems, networks, and data from cyber threats.

The term is analogous to personal hygiene - just as daily hand washing protects against disease, regular cyber hygiene practices protect against cyberattacks.

Cyber Hygiene in NIS2

The NIS2 Directive (Article 21(2)(g)) requires essential and important entities to implement:

“basic cyber hygiene practices and cybersecurity training”

This means cyber hygiene is no longer optional - it’s a legal requirement for organizations covered by NIS2.

Key Elements of Cyber Hygiene

For Individual Users

Practice	Description	Frequency
Strong passwords	Unique, complex passwords for each account	Every account creation
MFA	Multi-factor authentication	Whenever available
Updates	Installing security patches	Immediately upon release
Backups	Backing up important data	Minimum weekly
Link caution	Verifying before clicking	Every link
Screen lock	Automatic device locking	After 5 min inactivity

For Organizations

Practice	Description	Frequency
Password management	Password policy, password manager	Continuous
Patch management	Systematic system updates	Per schedule (min. monthly)
Asset inventory	Current list of devices and software	Quarterly
Network segmentation	Dividing network into security zones	At design
Employee training	Regular awareness training	Minimum annually
Vulnerability scanning	Automated vulnerability detection	Minimum monthly
Backup and DR testing	Backups and recovery tests	Backup: daily, tests: quarterly
Access control	Least privilege principle	Continuous

Cyber Hygiene Checklist

Passwords and Authentication

• Use passwords at least 12 characters long
• Don’t reuse passwords across different services
• Enable MFA wherever possible
• Use a password manager
• Regularly change passwords for privileged accounts

Updates and Software

• Enable automatic OS updates
• Update browsers and applications
• Uninstall unused software
• Use only licensed software
• Verify sources of downloaded files

Data and Backups

• Perform regular backups
• Store backups in a separate location
• Test backup restoration
• Encrypt sensitive data
• Securely dispose of unnecessary data

Network and Devices

• Use encrypted connections (HTTPS, VPN)
• Avoid public Wi-Fi without VPN
• Disable Bluetooth when not in use
• Lock device screens
• Don’t connect unknown USB devices

Threat Awareness

• Verify email senders
• Don’t click on suspicious links
• Report suspicious messages
• Participate in security awareness training
• Stay current on new threats

Benefits of Implementing Cyber Hygiene

1. Risk reduction - 80-90% of attacks can be prevented with basic practices
2. NIS2 compliance - meeting Article 21 requirements
3. Reputation protection - fewer incidents = better reputation
4. Cost savings - prevention costs less than incident response
5. Security culture - building awareness across the organization

Common Mistakes

• Weak passwords - “123456”, “password”, name+birthdate
• Delayed updates - postponing patch installation
• Clicking links - opening attachments without verification
• No backup - no backups or not testing them
• Excessive privileges - users with administrator privileges

Related Terms

• Essential Entity
• NIS2
• Security Awareness
• Risk Management

Cyber hygiene is the foundation of organizational security. Implementing basic practices doesn’t require large financial investments but significantly reduces the risk of a successful cyberattack. In the context of NIS2, it’s a legal obligation, and neglecting it can result in administrative penalties.