Firewall, MFA on accounts, backup that survives ransomware. We start with three to five high-impact actions, not a fear pitch.