01 — Passwords & Accounts

You use a password manager (e.g., Bitwarden, 1Password) and every account has a unique, strong password — no reuse across sites.
You have checked haveibeenpwned.com to see if your email address appeared in a known data breach, and changed any exposed passwords.
Default passwords have been changed on all devices and online accounts — no "admin/admin" or manufacturer defaults.
Accounts you no longer use have been deleted or deactivated to reduce your attack surface.
You do not share passwords with others — for shared accounts (e.g., streaming), you use built-in sharing or profile features instead.

02 — Two-Factor Authentication

Two-factor authentication (2FA) is enabled on your email account — this is your most critical account as it controls password resets everywhere else.
2FA is enabled on your banking, financial, government, and social media accounts.
Where possible, you use an authenticator app (e.g., Google Authenticator, Authy, Microsoft Authenticator) rather than SMS-based codes, which can be intercepted.
Backup codes for your 2FA-enabled accounts are saved securely — ideally in your password manager or a physically secure location.

Your phone, laptop, and tablet all have a PIN, password, or biometric lock (fingerprint/face ID) enabled.
Automatic operating system updates are enabled on all devices — including your phone — so security patches are applied promptly.
Full-disk encryption is enabled on your laptop: BitLocker on Windows, FileVault on Mac. This protects your data if the device is lost or stolen.
Your screen locks automatically after a short period of inactivity (1–2 minutes on a laptop, 30–60 seconds on a phone).
You do not leave devices unlocked or unattended in public places such as coffee shops, libraries, or airports.

You verify the sender's full email address carefully before clicking links or responding to urgent requests, especially those involving money or login credentials.
For unexpected emails with links, you navigate directly to the website by typing the URL rather than clicking the link in the email.
You do not open attachments from unknown senders or unexpected attachments from known contacts without verifying first.
You report phishing and suspicious emails using your email provider's "Report spam" or "Report phishing" feature to help protect others.

Privacy settings on all social media accounts have been reviewed and tightened — only people you trust can see your posts, contact info, and friend list.
You do not share personal details publicly online, such as your home address, phone number, date of birth, or daily routine.
You have reviewed which third-party apps have access to your social media accounts and revoked permissions for apps you no longer use.
You have searched your own name online to see what personal information is publicly visible and taken steps to remove or limit it where possible.

Your home router's default admin username and password have been changed to something unique and strong.
Your home Wi-Fi uses WPA3 or WPA2 encryption — not WEP or an open network. Check your router settings to confirm.
You have set up a separate guest Wi-Fi network for visitors and smart home devices (TVs, speakers, doorbells) to isolate them from your main devices.
Your router firmware is up to date — check the router's admin panel or the manufacturer's website for the latest version.

Important files — photos, documents, tax records — are backed up to at least one external location: a cloud service or a physical external drive.
You have verified that your backups can actually be restored — not just that they appear to exist.
Automatic backups are enabled on your phone (iCloud, Google Photos, or equivalent) so photos and contacts are not lost if your device is stolen or damaged.
Sensitive documents — passport scans, SIN/SSN, banking details — are not stored in unencrypted locations like email drafts, notes apps, or plain text files.