Finance failures are rarely "the system was hacked". They are a door one person can walk through alone: one person can both prepare and pay, a bank-detail change verified with one phone call, a backup that only exists on the network. Everything is computed in your browser - nothing is uploaded.
1. Segregation of duties. If "pay" and "book" sit with the same person, the books cannot show a matching trail. A small company can do this with three people: accountant prepares, owner approves, cashier pays.
2. Bank-detail changes. A phone call is not verification - caller ID can be spoofed. Call the number already on file, then see the person on video. This is the one rule we treat as non-negotiable.
3. "The boss said pay first." A real boss is not afraid of verification. A fake one is terrified of a phone call. The policy needs one line: any request bypassing approval gets "I'll follow the process".
4. What "three copies" actually means. Local, server/cloud, offline. The first two are on the network and ransomware encrypts both in one pass. Only the third saves you, and it must be physically disconnected and not writable.
5. Restore drills. A backup you have never restored is not a backup. Restoring one file a month and writing down the elapsed time is the only proof you can recover on the day it matters.