Security basics for small studios.
You do not need a security department. You need a short list that gets finished: sign-in protection, updates, backups, limited access and a plan for the bad day. We help you do it in that order.
Quick answer
For a small studio, CISA's guidance reduces to a few steps: automated backups, multi-factor sign in starting with admin and remote accounts, automatic updates, access limited to need and a plan for a bad day. We set these up and write down how they work. This is basic hygiene, not a certification.
Where small studios are exposed.
- 01
Passwords reused everywhere
A password from one breached site works on the NAS, the cloud storage and the review tool. A password manager and unique passwords remove that.
- 02
No second factor on the accounts that matter
Email, cloud storage, the NAS admin page and remote access are the doors to the footage. CISA lists multi-factor sign in, starting with administrative and remote accounts, as an early step.
- 03
Updates postponed for months
The NAS, the router and the laptops all run software with known flaws. Automatic updates and a monthly check close most of them.
- 04
Everyone is an administrator
When every account can change everything, one stolen login or one mistake reaches everything. Least privilege means people get what they need and no more.
- 05
No plan for the bad day
If a laptop is stolen or an account is taken over, who does what first? A one-page plan written on a calm day gets used on a bad one.
The list
Six things we set up first.
The order follows CISA's Cyber Essentials guidance for small organizations, adapted to a creative studio. NIST also publishes small business resources, which we draw on.
Backups that are tested
Automated, encrypted, with an off site copy and a restore test. See the backups page for how.
Multi-factor sign in
First on email, cloud storage, remote access and administrator accounts. Then everything else that supports it.
Updates on
Automatic updates for laptops and phones, a scheduled check of the NAS and router firmware, and retirement of anything unsupported.
Unique passwords
A password manager for the team and a rule that nothing important uses a password twice.
Access by need
Named accounts, access by project and a short list of administrators. Review it when a job ends.
A bad day plan
One page: who to call, what to disconnect, how to restore and who tells the client. Practice it once.
Devices and the network
The practical parts for a studio.
Disk encryption on laptops
FileVault on Macs and BitLocker on supported Windows editions, so a lost laptop does not hand over the footage.
A separate guest network
Visitors and personal devices stay off the network that holds the media.
Nothing exposed to the internet
File sharing and remote desktop are reached through a VPN or managed access, not through open ports.
A short written description
Where media lives, who has access, how it is backed up and how people are removed. Clients and assessors ask for this.
Client content security
How we handle footage, and the TPN hub.
Studios and streamers set their own requirements for the content they send. Our content security page describes how we handle client footage, and our TPN hub explains the Trusted Partner Network in plain English. An independent assessor does any assessment.
Before you hire anyone
What to ask any IT provider.
Ask us the same questions. A good answer is specific and can be checked.
Which of these do you do for a studio our size?
A short list in priority order, not a long catalog.
Will you tell us what you cannot guarantee?
Yes. Security reduces risk and cannot remove it, and anyone who promises otherwise should worry you.
Who holds the admin accounts?
You do, with a break-glass record kept safely.
How do you know the updates happened?
A monthly check and a record, not an assumption.
What do we hand a client who asks about our security?
A short, accurate description you can stand behind.
Questions people ask
Does this make us TPN compliant?
No. TPN assessments are done by an independent assessor, and each content owner sets its own requirements. These basics are a sensible foundation and match many of the things assessors ask about.
Is a password manager really worth it?
Yes for most teams. It makes unique passwords practical and lets you share the few passwords that must be shared without passing them around in chat.
What does multi-factor sign in cost?
Many services include it at no extra cost, using an authenticator app or a hardware key. CISA recommends phishing-resistant options where they are available. We help you pick one that suits the team.
Do we need antivirus?
Modern operating systems include built-in protection. We look at what each machine has and what your clients require, and add to it where it makes sense.
Can you check our setup without changing it?
Yes. A review produces a written list in the order we would fix it, and you decide what we do.
Plug us in. Tell us what your studio runs on.
Tell us what you see on screen. A person on our production consulting team reads it and replies, usually with the first thing to check.
Keep reading
The 3-2-1 rule for footage and projects, off site copies, immutability and restore tests.
A checklist for adding and removing freelancers, accounts and devices without leaving access behind.
How editors reach studio storage and machines securely, and where a VPN helps and where it does not.
Plain-English guides to the Trusted Partner Network and getting ready for an assessment.
How we handle client footage.
Security assessment, MPA best-practice review and help preparing for TPN.
Creative studios handle valuable pre-release content, client data, and proprietary materials. These network security fundamentals protect your studio and your client relationships.
The MPA Content Security Best Practices explained without jargon: the current version, how the controls are organized and what they ask of a small vendor.
Describe your studio and we will take it from there.
A real person on our team reads every request and replies within one business day.