Small-business cybersecurity is not a one-time software purchase. It is a set of operating habits that protect accounts, devices, money, customer information, and the ability to keep serving customers.
Start with the controls that reduce common paths into the business and make recovery possible when prevention fails. This guide is a baseline, not a penetration test, compliance assessment, or substitute for a qualified security professional.
1. Know what you need to protect
Create a simple inventory of:
- email and identity accounts;
- financial and payment systems;
- customer and employee information;
- websites, domains, hosting, and code repositories;
- cloud storage and collaboration tools;
- laptops, phones, routers, and other devices;
- critical vendors and integrations; and
- backups and recovery contacts.
For each item, record the business owner, technical administrator, data involved, login method, recovery method, and impact if it becomes unavailable or exposed.
NIST’s Cybersecurity Framework 2.0 organizes security work around Govern, Identify, Protect, Detect, Respond, and Recover. A small inventory supports all six functions.
2. Secure email first
Email can reset passwords for many other systems, receive invoices, and impersonate leadership. Treat it as critical infrastructure.
- Require multi-factor authentication (MFA) for every email account.
- Prefer phishing-resistant methods such as passkeys or hardware security keys where supported.
- Use individual accounts rather than shared credentials.
- Review forwarding rules and recovery methods.
- Remove access promptly when a person leaves.
- Protect administrators more strongly than ordinary users.
SMS-based MFA is generally better than no MFA, but more phishing-resistant options can provide stronger protection. Choose the strongest method each critical system supports and maintain recovery procedures that do not weaken it.
3. Use unique credentials and a password manager
Password reuse turns one breached service into access to several accounts. Give every service a unique credential and store it in a reputable business password manager.
Modern guidance emphasizes long passwords, blocking commonly used or compromised values, allowing password managers, and avoiding arbitrary periodic changes when there is no evidence of compromise. NIST’s current Digital Identity Guidelines provide the underlying authentication guidance; each organization should apply it to its systems and risk.
For shared access, use the password manager’s team vault and permissions. Do not send credentials through email, chat, documents, or a website form.
4. Build a phishing-resistant payment process
Phishing succeeds by creating urgency, authority, or a plausible change in routine. Train people to pause when a message asks them to:
- change payment or banking details;
- buy gift cards or make an unusual transfer;
- share a password or MFA code;
- open an unexpected attachment;
- install remote-access software;
- bypass normal approval; or
- keep the request secret.
Create a rule: payment-detail changes and high-risk requests must be confirmed through a known, separate channel. Call the vendor using a number already on file, not a number in the suspicious message.
Training should include a clear reporting button or contact. Do not punish people for reporting a possible mistake quickly; early reporting gives the business a chance to contain it.
5. Update devices and software
Use supported operating systems and software. Turn on automatic security updates where practical, and assign an owner for systems that require manual maintenance.
Prioritize:
- internet-facing services;
- browsers and browser extensions;
- email and collaboration tools;
- routers and remote-access software;
- website platforms, plugins, and dependencies; and
- systems with known exploited vulnerabilities.
Remove software and accounts the business no longer uses. Every unused integration is another permission to forget.
6. Back up what the business cannot recreate
A backup is useful only if it can be restored. Keep protected copies that are separated from normal user access so ransomware or an accidental deletion cannot remove every version.
Define:
- what is backed up;
- how frequently;
- where copies live;
- who can restore them;
- how long restoration should take; and
- when the last restore test succeeded.
Test a small recovery regularly and a full critical-system recovery on a planned schedule. Screenshotting a “backup complete” message is not proof of recovery.
7. Limit access and separate authority
Give each person only the access needed for their role. Use separate administrator accounts for administrative work, and do normal work from lower-privilege accounts.
For high-impact actions, separate duties where possible. The person who requests a payment change should not be the only person who approves it. The person who drafts a public change may not be the person authorized to publish it.
Review access quarterly and whenever someone joins, changes roles, or leaves.
8. Manage vendors and connected apps
List vendors that can access business data or critical systems. Before connecting a new tool, ask:
- What information and permissions does it receive?
- Is that access necessary for the task?
- How does the vendor protect and retain information?
- Can access be limited and revoked?
- What happens if the vendor is unavailable?
- How will the business learn about an incident?
Review OAuth connections, API keys, service accounts, and browser extensions. Revoke anything unused and rotate exposed secrets immediately.
9. Prepare a short incident plan
Write down what to do before something happens:
- Who makes the incident decision?
- How will the team communicate if email is compromised?
- Which vendor, insurer, counsel, bank, or specialist should be called?
- How will affected accounts be contained?
- Where are logs and backups?
- Which notification duties might apply?
- Who speaks to customers or the public?
Keep an offline or otherwise protected copy of critical contacts. Run a tabletop exercise using a plausible scenario such as a compromised email account or fraudulent banking change.
A 30-day baseline
Week 1: Accounts
- Inventory critical systems and owners.
- Require MFA for email, finance, hosting, domains, and admin accounts.
- Deploy a business password manager.
Week 2: Devices and access
- Apply updates and remove unsupported software.
- Review administrators, former users, and connected apps.
- Encrypt supported laptops and phones and enable device locks.
Week 3: Recovery
- Confirm critical backups.
- Perform a restore test.
- Document how to regain access to email, domains, and financial systems.
Week 4: People and response
- Train the team on payment and credential phishing.
- Publish one reporting path.
- Run a short incident exercise and assign fixes.
CISA maintains cyber guidance for small and medium businesses, and the FTC provides a small-business cybersecurity library. Use those primary resources to update the baseline as threats and guidance change.
Security work should remain prioritized like any other business backlog: evidence, severity, readiness, owner, and proof of completion. The best control is one the team can operate consistently and verify when it matters.