Small Business Cybersecurity Basics: The Controls That Matter Most

Most incidents at small organizations do not involve sophisticated attacks. They start with a stolen password, a convincing email, an unpatched computer, or a backup that turned out not to work. Those are exactly the problems the basics prevent.

Security products are easy to buy and hard to judge. The fundamentals below cost little, and getting them right does more for a small business than any single tool. Treat this as a checklist to work through, not a shopping list.

Multi-factor authentication, sometimes called two-step sign-in, means a password alone is not enough to get into an account. It is the single most effective protection against stolen or guessed passwords.

Start with email, because access to email usually means access to everything else through password resets. Then cover banking, payroll, your accounting system, file storage, and any administrator account. Prefer an authenticator app over text messages where you can.

A backup you have never restored is a hope, not a plan. Keep at least one copy of important data somewhere an attacker on your network could not reach or delete, and test restoring a real file on a schedule.

Remember cloud services too. Files in Microsoft 365 or Google Workspace are not automatically protected from accidental deletion or ransomware beyond the provider's retention period. Know how long that period is and whether it is long enough for you.

Turn on automatic updates for operating systems, browsers, and common applications, and replace devices that no longer receive security updates. An old computer that cannot be updated is an open door.

Keep a simple list of every laptop, phone, and computer that touches business data, who uses it, and whether the disk is encrypted. You cannot protect a device you do not know about.

Most attacks arrive by email. Make sure your email system's built-in filtering is switched on, and set up the domain records that help receiving servers spot messages pretending to be from you.

Train people to slow down on any message about money, passwords, or urgent changes to payment details. A short phone call to a known number, not the one in the email, stops most invoice and payroll fraud.

Few people should have administrator access, and nobody should use an administrator account for everyday email and browsing. Separate accounts limit the damage if one is compromised.

When someone leaves, disable their accounts the same day and change any shared passwords they knew. A password manager makes this far easier, because shared credentials live in one place instead of in people's heads and spreadsheets.

An incident plan for a small business can fit on one page: who to call, how to reach them if email is down, how to contact your bank and insurer, and how to restore from backup. Writing it down in advance turns a panic into a checklist.

If you carry cyber insurance, read the policy's requirements. Many insurers now ask about multi-factor authentication, backups, and training, and a claim can depend on your answers being true.

Go through each section above and answer honestly: is it in place, is it partly in place, or do we not know? The items you cannot answer are usually the ones to look at first.

If you want an outside view, a cybersecurity baseline review checks these controls in your actual environment, ranks what it finds by risk, and gives leadership a short, plain-English plan. It is an advisory review, not a penetration test or ongoing monitoring.