A security policy, as three doors

Picture this: you step away, and someone reads an open customer order. Think of work information as a room with three doors: your screen, your accounts, your inbox. Lock your screen whenever you leave, even briefly; don't trust the timer.

At the account door, make each password unique, at least 14 characters, and store it in the company password manager. Turn on two-factor authentication wherever available. It asks for your password and a second check, so a stolen password alone isn't enough.

At the inbox door, an unexpected supplier invoice could be phishing: a message trying to trick you. Don't click; report it within one hour, even if you clicked. Keep data on company systems; report lost devices immediately. How do you close the three doors? Lock screens, use two-factor authentication, report phishing.