| Important accounts | Main email, banking, Apple, Google or Microsoft accounts are identified and recovery details are checked. | Accounts are dealt with one at a time, usually after access is lost or a warning appears. |
| Passwords | Important accounts have unique passwords, with a password manager and stronger sign in protection where available. | Passwords are reused or only changed after a problem. |
| Devices | Updates, screen locks and lost device tools are set up. Older devices are reviewed and removed. | The household assumes updates and security settings are already taken care of. |
| Backups | Important files and photos are included in a backup, and at least one restore has been checked. | It is assumed that cloud storage automatically covers everything. |
| Scams | Unexpected requests are checked through a trusted contact route before money, codes or information are shared. | A decision is made under pressure using the details in the message or call. |
| Recovery | First steps, official recovery pages and key contact details are known before they are needed. | Help is searched for during the incident, when it is harder to judge what is genuine. |
| Review | Accounts, devices and recovery details are reviewed at sensible intervals. | The setup is only revisited after a warning, loss or compromise. |