Almost all security advice is written as one-off tasks: install this, enable that, check the other. People do them once, and a year later the picture no longer matches reality — the phone changed, services were added, recovery contacts went stale.
Below is the same material spread across intervals. Each item takes minutes and none of them requires bracing yourself.
Monthly: five minutes
Quarterly: twenty minutes
Yearly: one evening
By event, not by calendar
| What happened | What to do |
|---|---|
| News of a breach at a service you use | Change the password there and everywhere it was reused |
| Changing phones | Move the second factor before wiping the old one — the order |
| Changing your number | Update it at the bank and in email while the old one still works |
| Selling a device | Unlink and wipe — what exactly |
| A break-up, leaving a job, moving house | Revoke shared access and change shared passwords |
| A password typed on a suspicious page | Change it immediately, without waiting for confirmation of the suspicion |
If the list feels long, start with the one-evening audit: it covers the essentials, and after that only maintenance is left.