10 March 2022
Sector: Membership / association
Focus: Hosting, Support & Maintenance, Website Design & Development
Situation
Hosting was shared and patching was opaque, backups had not been meaningfully tested, and admin passwords had become communal habits. That is a calm week until it is not.
What we focused on
- Hardening: Least privilege, MFA, and separation of duties for hosting access.
- Update rhythm: Staging first, change notes, and rollback paths for plugins that mattered.
- Restore drills: Quarterly test restores, proof backups weren’t decorative.
Outcome
Lower incident anxiety and a maintenance cadence the volunteer board could understand.