Know what is supported
Maintain an inventory of devices, software, accounts and vendors. Agree supported equipment, response hours, patch responsibilities and exclusions in the service contract. A maintenance plan is not a guarantee of regulatory compliance or uninterrupted service.
Prioritize useful controls
Use MFA, least privilege, endpoint protection and timely updates. Review joiner, mover and leaver access. Test backups, teach phishing reporting and review privileged activity. Collect enough logs to investigate issues without routinely capturing passwords or message contents.
Prepare for incidents
Assign a decision-maker and an escalation route. Plan containment, evidence preservation, recovery and communication. Assess regulatory and contractual notifications promptly with the responsible adviser; do not assume one notification deadline applies to every incident.
Planning recommendations are distinct from legal obligations. Confirm the rules and current specifications for your facility, sector and contract. This guide is not a certification or legal opinion.