Download the check-list. List your accounts and devices, test your address on Have I Been Pwned, identify your 3 weakest points and your organisation's security contact. Starting score noted.
Install the password manager, migrate 3 critical accounts (e-mail first) to unique passwords, enable 2FA (app) on e-mail + bank + work account, save the recovery codes, set automatic lock everywhere.
Take an online anti-phishing quiz (e.g. Google's test), inspect 5 real e-mails with the 5-point check-list, forward a fraudulent SMS to 33700, and check with the person who pays: does dual validation of transfers/IBANs exist?
Implement the 3-2-1 (cloud + offline external drive), test ONE restore, verify encryption on your laptop and phone, harden your router (admin password, WPA2/3, guest network) and test the company VPN.
Audit a file containing personal data (purpose, minimization, access, retention), fix its sharing, purge an expired folder, identify the DPO and write your "mis-send" procedure in 3 lines.
Write your incident reflex sheet (5 lines + real contacts), set up the reporting directory (internal, 33700, Signal Spam, Cybermalveillance), sign up to SecNumacadémie, and run a 5-minute awareness session for your team with ONE reflex from the guide.