[Blog](/blog) Show links Resources [Blog](/blog) [Breaches](/breaches) [eBooks, reports, & more](/resources) [Events](/events) [News](/news) [Cybersecurity](/category/cybersecurity) Show links Categories [Attack Surface Management](/category/attack-surface-management) [Company News](/category/company-news) [Compliance and Regulations](/category/compliance-and-regulations) [Cybersecurity](/category/cybersecurity) [Data Breaches](/category/data-breaches) [DevOps](/category/devops) [Human Cyber Risk](/category/human-cyber-risk) [Risks and Vulnerabilities](/category/risks-and-vulnerabilities) [Third-Party Risk Management](/category/third-party-risk-management) [Vendor Risk Management](/category/vendor-risk-management) [What is Cyber Hygiene and Why is it Important?](/blog/cyber-hygiene) Publish date November 30, 2025 {x} minute read # What is Cyber Hygiene and Why is it Important? [Get a demo](/contact-sales) [Free trial](/demo) [Download the PDF guide](/resources/complete-guide-to-data-breaches) [Free trial](/demo) Written by [Abi Tyas Tunggal](/team/abi-tyas-tunggal) Writer and Senior Product Manager at UpGuard. Abi's work has influenced leaders across cybersecurity, technology, and financial services. Reviewed by [Kaushik Sen](/team/kaushik-sen) Chief Marketing Officer Kaushik has a background in software engineering, enterprise solution architecture, and data analytics. He brings a unique, data-driven perspective to cybersecurity education. Table of contents eBook A Complete Guide to Data Breaches Free resource ### A Complete Guide to Data Breaches Learn how to avoid a costly data breach with a comprehensive prevention strategy. [Download now](/resources/complete-guide-to-data-breaches) Cyber hygiene is the [cybersecurity](https://www.upguard.com/blog/cyber-security) equivalent to the concept of personal hygiene in public health literature.  The European Union's [Agency for Network and Information Security (ENISA)](https://www.enisa.europa.eu/publications/cyber-hygiene/) states that "cyber hygiene should be viewed in the same manner as personal hygiene and, once properly integrated into an organization will be simple daily routines, good behaviors, and occasional checkups to make sure the organization's online health is in optimum condition".  However, the report found there was no consensus on what cyber hygiene meant or even entailed. Various nations have their own recommendations and advisories, such as the [NIST Cybersecurity Framework](https://www.upguard.com/blog/nist-cybersecurity-framework), but there is no single standard or commonly agreed-upon mechanism for an organization to assess, evaluate, or demonstrate cyber hygiene.  At [UpGuard](https://www.upguard.com/), we believe good cyber hygiene practices create a [strong security posture](https://www.upguard.com/blog/security-posture), as measured by a [security rating](https://www.upguard.com/blog/what-are-security-ratings). The higher your security rating, the better your security practices, and the better you can [prevent data breaches](https://www.upguard.com/blog/prevent-data-breaches), [cyber attacks](https://www.upguard.com/blog/cyber-attack), [phishing](https://www.upguard.com/blog/phishing), [malware](https://www.upguard.com/blog/malware), [ransomware](https://www.upguard.com/blog/ransomware), [exposure of personal data](https://www.upguard.com/blog/data-leak), and other [cyber threats](https://www.upguard.com/blog/cyber-threat).  In short, cyber hygiene encompasses your hardware, software, IT infrastructure, cybersecurity awareness training, and increasingly, your employee's own devices.  ## Why is Cyber Hygiene Important? In today's [ever-changing threat landscape](https://www.upguard.com/blog/cyber-threat-landscape), it's more important than ever to create a cyber hygiene routine that can prevent cybercriminals from causing [security breaches](https://www.upguard.com/blog/data-breach), [installing different types of malware](https://www.upguard.com/blog/types-of-malware), and stealing [personal information](https://www.upguard.com/blog/personally-identifiable-information-pii) from you and your customers.  Many organizations rely almost exclusively on cybersecurity professionals to carry out day-to-day tasks designed to protect themselves and their end-users' [sensitive data](https://www.upguard.com/blog/sensitive-data). This is a mistake. Every employee needs to understand basic cyber hygiene practices and their role in protecting and maintaining your IT systems and devices. This will enable better [incident response](https://www.upguard.com/blog/incident-response-plan) and provide immediate and effective defenses against cyber attacks.  It doesn't matter whether you have 10 or 10,000 employees, the world is becoming increasingly connected, and the size and impact of data breaches is on the rise. For context, there have been at least [34 data breaches that have exposed more than 55 million people](https://www.upguard.com/blog/biggest-data-breaches).   And it's not just the large breaches that cost money, according to the [Cost of Data Breach Report](https://www.ibm.com/reports/data-breach) from Ponemon Institute and IBM Security, the [global average cost of a data breach has grown by 12 percent in the last five years to $3.92 million](https://www.upguard.com/blog/cost-of-data-breach).  Beyond improving security, cyber hygiene can also help your hardware and software run at peak efficiency. Without maintenance, files can become fragmented and programs can become outdated. Not only does patching reduce the risk of [exploitable vulnerabilities](https://www.upguard.com/blog/exploit), it can also introduce new or improve existing functionality.  ## What are Common Cyber Hygiene Problems? You likely have multiple [attack vectors](https://www.upguard.com/blog/attack-vector) that are in need of cyber hygiene. All hardware (computers, mobile devices, connected devices, hard drives, and cloud storage), software programs, SaaS applications likely need regular, ongoing maintenance. Each of these systems can become vulnerable over time as new vulnerabilities are listed on [CVE](https://www.upguard.com/blog/cve). Common cyber hygiene problems include: * **Loss of data:** Hard drives, online cloud storage and SaaS apps that store sensitive data that isn't backed up or maintained can be vulnerable to hacking, corruption, [data leaks](https://www.upguard.com/blog/data-leak), and data breaches. To learn how to fix this problem, [read our guide on data loss prevention](https://www.upguard.com/blog/data-loss-prevention).   * **Misplaced data: **Poor cyber hygiene could mean losing data in other ways, while it may not be corrupted or gone for good, it's increasingly common to misplace data due to the myriad of places it can be stored. This is why [robust data classification is important](https://www.upguard.com/blog/data-classification).  * **Security breaches: **Data breaches are becoming increasingly common, and costly. [Spear phishing](https://www.upguard.com/blog/spear-phishing), [whaling attacks](https://www.upguard.com/blog/whaling-attack), lack of [configuration management](https://www.upguard.com/blog/5-configuration-management-boss), and poor [network security](https://www.upguard.com/blog/network-security) can all lead to exposure of trade secrets, [PII](https://www.upguard.com/blog/personally-identifiable-information-pii), and [PHI](https://www.upguard.com/blog/protected-health-information-phi). This can result in customer identity theft, [industrial espionage](https://www.upguard.com/blog/corporate-espionage), and a loss of market position. * **Outdated software: **Software applications must have security patches applied regularly to prevent known vulnerabilities. The success of the [WannaCry ransomware ](https://www.upguard.com/blog/wannacry)[computer worm](https://www.upguard.com/blog/computer-worm) is a great example of why patching operating systems is an important part of good cyber hygiene. To learn more, [read our guide on vulnerability management here](https://www.upguard.com/blog/vulnerability-management). * **Old security software: **Antivirus software and other security software must be kept up to date to keep pace with the ever-changing threat landscape. Additionally, you may find it helpful to invest in [continuous security monitoring](/blog/continuous-security-monitoring).   * **Poor or lack of vendor risk management: **Gone are the days where you can think solely about your organization's security posture. Chances are a number of your third-party vendors and service providers have access to** **your Wi-Fi networks or process sensitive data on your behalf. This is why vendor risk management is so important. Additionally, you may have a regulatory requirement to focus on [third-party risk management](https://www.upguard.com/blog/third-party-risk-management-framework), e.g. [FISMA](https://www.upguard.com/blog/fisma), [CPS 234](https://www.upguard.com/blog/apra-cps-234-information-security-prudential-standard), [GLBA](https://www.upguard.com/blog/glba), [SOX](/blog/sox-compliance), PCI DSS and HIPAA. For more information, read our guide on [Vendor Risk Management](https://www.upguard.com/blog/vendor-risk-management). ## What are Cyber Hygiene Best Practices? Cyber hygiene best practices are really just cybersecurity best practices. [The Center for Internet Security (CIS) Controls for Effective Defense](https://www.upguard.com/blog/cis-controls) is a good place to start. The CIS Controls for Effective Defense can be broken up into three groups: 1. Basic CIS Controls 2. Foundational CIS Controls 3. Organization CIS Controls ### What are the Basic CIS Controls? There are six controls in the basic CIS controls, namely: 1. **Inventory and control of hardware assets: **This control requires organizations to manage hardware devices on their network to ensure only authorized devices have access to sensitive areas. 2. **Inventory and control of software assets: **This control mitigates this risk by requiring organizations to actively manage all software on the network so only authorized software is installed and can execute.  3. **Continuous vulnerability management: **This control requires organizations to continuously acquire, assess and take action on new information in order to identify vulnerabilities, remediate them and minimize the window of opportunity.  4. **Controlled use of administrative privileges: **The [principle of least privilege](https://www.upguard.com/blog/principle-of-least-privilege) and other [access control](https://www.upguard.com/blog/access-control) methods, such as [two-factor authentication](https://www.upguard.com/blog/two-factor-authentication) or multi-factor authentication, are designed to create processes and tools to track, control, prevent and correct the use, assignment, and configuration of administrative privileges. 5. **Secure configuration of hardware and software on mobile devices, laptops, workstations and servers: **Organizations must establish, implement and actively manage the security configuration of mobile devices, laptops, servers and workstations using configuration management and change control processes to prevent attackers from exploiting vulnerable services and settings. This should include the use of complex passwords. [To learn how to create strong passwords, read our password security checklist](https://www.upguard.com/blog/the-password-security-checklist). 6. **Maintenance, monitoring and analysis of audit logs: **Organizations must collect, manage and analyze audit logs of events to help the detection, identification and to recover from attacks.  ### What are the Foundational CIS Controls? There are ten controls in the foundational CIS controls, namely: 1. **Email and web browser protections: **This control can minimize the [attack surface](/blog/attack-surface) and opportunities for attackers to manipulate human behavior through their interaction with web browsers and email systems. [Read our guide on email security for more information](https://www.upguard.com/blog/email-security). 2. **Malware defenses: **Organizations must control the installation, spread, and execution of malicious code while optimizing the use of automation to enable rapid updating of defense, data gathering, and corrective action. 3. **Limitation and control of network ports, protocols, and services: **This control must manage the ongoing operational use of ports, protocols, and services on networked devices in order to minimize windows of vulnerability available to attackers. [To learn more, read our guide on open ports](https://www.upguard.com/blog/open-port). 4. **Data recovery capabilities: **Organizations must use processes and tools to properly back up critical information with a proven methodology for timely recovery of it.  5. **Secure configuration of network devices, such as firewalls, routers, and switches: **Organizations must establish, implement and actively manage the security configuration of network infrastructure devices by using configuration management and change control processes to prevent attackers from exploiting vulnerable services and settings.** ** 6. **Boundary defense: **Boundary defense controls detect, prevent and correct the flow of information transferring across networks of different trust levels with a focus on security-damaging data. 7. **Data protection: **Sensitive data resides in many places. The protection of that data is best achieved through the combination of [encryption](https://www.upguard.com/blog/encryption), integrity protection, and [data loss prevention techniques](https://www.upguard.com/blog/data-loss-prevention). 8. **Controlled access based on the need to know: **Organizations must have processes and tools to track, control, prevent and correct secure access to critical assets according to access control rights of people, computers, and applications based on a need or right previously classified. [Read more about access control](https://www.upguard.com/blog/access-control) and [the principle of least privilege here](https://www.upguard.com/blog/principle-of-least-privilege).  9. **Wireless access control: **Wireless access controls are processes and tools to track, control, prevent and correct the secure use of wireless local area networks (WLANs), access points and wireless client systems. 10. **Account monitoring and control: **This control requires active management across the life cycle of system and application accounts - their creation, use, dormancy, and deletion - to minimize opportunities for attackers. ### What are the Organizational CIS Controls?  There are four organizational CIS controls, namely: 1. **Implement a security awareness, and training program: **Organizations must identify the specific knowledge, security skills and abilities needed to support the defense of the organization, develop and execute a plan to assess, identify gaps and remediate through policy, planning, training and awareness programs. 2. **Application software security: **Organizations must manage the security of all in-house and acquired software over its life cycle. 3. **Incident response and management: **Organizations must protect their information and reputation by developing and implementing an incident response infrastructure (e.g. plans, defined roles, training, communications, management oversight) to quickly discover attacks and then contain the damage, eradicate the attacker's access and restore the integrity of the network and systems.  4. **Penetration tests and red team exercises: **Organizations must test their overall defense (technology, processes, and people) by simulating the objectives and actions of an attacker.** **This may include [on-site and off-site penetration testing](https://www.upguard.com/blog/penetration-testing), [network security assessments](https://www.upguard.com/blog/network-security-assessment) and testing the implementation of [information security policies](https://www.upguard.com/blog/information-security-policy).  ## How Can I Measure My Cyber Hygiene? [Security ratings](https://www.upguard.com/blog/what-are-security-ratings) are a great, and increasingly common, way to measure the effectiveness of your cyber hygiene.  Security ratings or cybersecurity ratings are a data-driven, objective, and dynamic measurement of an organization's [security posture](https://www.upguard.com/blog/security-posture). They are created by a [trusted, independent security rating platform](https://www.upguard.com/) making them valuable as an objective indicator of an organization's [cybersecurity performance](https://www.upguard.com/blog/cybersecurity-performance-management). Just as credit ratings aim to provide a quantitative measure of credit risk, security ratings aim to provide a quantitative measure of [cybersecurity risk](https://www.upguard.com/blog/cybersecurity-risk).   The higher your security rating, the better your organization's cyber hygiene practices. Unlike traditional risk assessment techniques like penetration testing, [security questionnaires](https://www.upguard.com/blog/vendor-risk-assessment-questionnaire-template), and on-site visits, security ratings are derived from objective and externally verifiable information.  [Learn about the top questionnaires here](/blog/top-vendor-assessment-questionnaires). [UpGuard](https://www.upguard.com/) is one of the most popular and trusted security ratings platforms. With UpGuard, an organization's security rating can range from 0 to 950 and is comprised of a weighted average of the risk rating of all externally facing assets, such as web applications, IP addresses, and marketing sites. To keep our security ratings up-to-date, we recalculate sores whenever a website is scanned or a [security questionnaire](https://www.upguard.com/blog/security-questionnaire) is submitted. In general, this means an organization's security rating will be updated multiple times a day, as most websites are scanned daily.  We base our ratings on the analysis of 70+ vectors including: * [Susceptibility to man-in-the-middle attacks](https://www.upguard.com/blog/man-in-the-middle-attack) * [Insecure SSL/TLS certificates](https://www.upguard.com/blog/ssl-certificate) * [SPF, DKIM and DMARC settings](https://www.upguard.com/blog/email-security) * [HTTP Strict Transport Security (HSTS)](https://www.upguard.com/blog/hsts) * [Email spoofing and phishing risk](https://www.upguard.com/blog/email-spoofing) * [Vulnerabilities](https://www.upguard.com/blog/vulnerability) * [Malware susceptibility](https://www.upguard.com/blog/types-of-malware) * [Network security](https://www.upguard.com/blog/network-security) * Unnecessary open administration, database, app, email and file sharing ports * Exposure to known [data breaches](https://www.upguard.com/blog/data-breach) and [data leaks](https://www.upguard.com/blog/data-leak) * Vulnerable software * HTTP accessibility * Secure cookie configuration * Results of[ vendor risk assessment questionnaires](https://www.upguard.com/blog/vendor-risk-assessment-questionnaire-template) If you are considering other security rating services, like SecurityScoreCard or BitSight Technologies, see our guide on[ SecurityScorecard security ratings vs BitSight security ratings here](https://www.upguard.com/compare/bitsight-vs-securityscorecard). ## How to Use UpGuard to Measure Your Cyber Hygiene in Real-Time Companies like [Intercontinental Exchange](https://www.upguard.com/customers/ice-nyse), [Taylor Fry](https://www.upguard.com/customers/taylor-fry), [The New York Stock Exchange](https://www.upguard.com/customers/ice-nyse), IAG, First State Super, Akamai, Morningstar, and NASA use UpGuard's security ratings to protect their data, [prevent data breaches](https://www.upguard.com/blog/prevent-data-breaches) and assess their security posture. [UpGuard Vendor Risk](https://www.upguard.com/product/vendorrisk) can minimize the amount of time your organization spends assessing related and third-party information security controls by automating vendor questionnaires with its [security questionnaire automation tool](https://www.upguard.com/product/vendor-risk/questionnaire-management). For the assessment of your information security controls, [UpGuard Breach Risk](https://www.upguard.com/product/breach-risk) can monitor your organization for 70+ security controls and automatically [detect leaked credentials and data exposures](https://www.upguard.com/product/breach-risk) in S3 buckets, Rsync servers, GitHub repos and more. eBook A Complete Guide to Data Breaches Free resource ### A Complete Guide to Data Breaches Learn how to avoid a costly data breach with a comprehensive prevention strategy. [Download now](/resources/complete-guide-to-data-breaches) ## Related posts Learn more about the latest issues in cybersecurity. Cybersecurity #### [12 Cybersecurity Horror Stories of 2026 (No Costume Required)](/blog/cybersecurity-horror-stories-2026) A warning ignored once becomes a headline. Read more about these 12 real 2026 cybersecurity incidents, and the sign each one gave before it made the news. [](/team/revashni-moodley) [Revashni Moodley](#) October 14, 2026 Cybersecurity #### [Left Unsupervised: 10 Times Access Outlived Its Authorization](/blog/10-times-access-outlived-authorization) Access granted once shouldn’t mean access forever. Read more on how unmonitored access caused 10 of these real-life breaches and what they taught us. [](/team/revashni-moodley) [Revashni Moodley](#) August 25, 2026 Cybersecurity #### [Surviving a LockBit Ransomware Attack: The ROI of Visibility](/blog/surviving-a-lockbit-ransomware-attack) Read how veteran CISO Nick Gicinto saved his alma mater from a LockBit ransomware attack by discarding the standard playbook. [](/team/nicholas-sollitto) [Nicholas Sollitto](#) June 1, 2026 Cybersecurity #### [Top 10 Security Events of 2025](/blog/top-security-events-of-2025) Recap the ten most impactful events that reshaped the cybersecurity industry this year and the critical lessons each had to teach us. Read more here. [](/team/revashni-moodley) [Revashni Moodley](#) October 14, 2026 Cybersecurity #### [Risk Automations: The Shift From Catch-Up to Command](/blog/risk-automations-shift-catch-up-to-command) Connect intelligence to system execution with Risk Automations, your new resolution layer for risk. Reduce remediation from hours to seconds - read more. [](/team/revashni-moodley) [Revashni Moodley](#) December 1, 2025 Cybersecurity #### [Shai-Hulud's True Lesson for CISOs: A Crisis of Communication](/blog/shai-hulud-lesson-for-cisos) Shai-Hulud was driven by a communication crisis between security and engineering. Get a CISO's perspective on how to finally bridge this gap. [](/team/phil-ross) [Phil Ross](#) September 3, 2026 [All posts](/blog) Experience superior visibility and a simpler approach to cyber risk management [Get a demo](/contact-sales) [Free trial](/demo)