New article: A practical cybersecurity guide for business owners, executives, and nontechnical professionals.
Consider an illustrative scenario: An invoice arrives from a familiar vendor. The amount looks right, the timing makes sense, and the message asks you to use a new bank account.
Before you pay, what happens next?
If the answer depends entirely on whether someone thinks the email looks suspicious, your business has a fragile defense. The message might be convincingly forged—or sent from a genuinely compromised account. A safer process requires independent confirmation before money moves.
That distinction captures what effective cybersecurity looks like. It is not simply buying software or teaching employees to spot spelling mistakes. It is building dependable ways to protect access, verify sensitive requests, detect trouble, and restore operations.
Cybersecurity is a business responsibility: decide what matters, control who can reach it, and practice what happens when those controls fail.
Start With the Business, Not the Technology
The first question is not “Which security product should we buy?” It is “What would hurt this business most if it became unavailable, exposed, or altered?”
For one organization, that might be payroll and banking. For another, it could be customer records, production systems, or access to a cloud platform that runs daily operations.
Create a short inventory of those essential systems. For each, identify its business owner, who has access, which outside providers support it, and how work would continue during an outage. Include sensitive information stored in email, shared folders, and employee devices—not just formal databases.
The NIST Cybersecurity Framework 2.0 small-business guidance organizes this work around six functions: Govern, Identify, Protect, Detect, Respond, and Recover. The practical lesson is straightforward: prevention is only part of the job. Leadership, visibility, response, and recovery need owners, too.
Strengthen the Accounts That Matter Most
Email, financial, and administrator accounts deserve early attention. Email often supports password resets and business approvals. Administrator accounts can change settings, create users, and access information across multiple systems.
Use Strong Authentication
Enable multifactor authentication, or MFA, wherever available. It requires an additional proof of identity beyond a password, making a stolen password less useful to an attacker.
But MFA methods are not equally protective. As NIST’s MFA guidance explains, one-time codes, including SMS codes, can be captured through phishing. For sensitive applications and privileged users, prioritize phishing-resistant authentication where supported.
Passkeys are another option worth evaluating. The UK National Cyber Security Centre recommends passkeys for supported services and two-step verification where passkeys are unavailable. Passkeys reduce common password-related risks, but device security, credential-manager protection, and account recovery still matter.
Make Secure Access Sustainable
Use a password manager to generate and store strong, unique passwords for accounts that still require them. Protect the manager itself with strong authentication. Keep recovery information secure and available to authorized people when needed.
For example, a business should not discover during an emergency that its only administrator is unavailable and nobody else can access essential systems. Document authorized backup access without creating broadly shared credentials.
Verify Sensitive Requests Outside the Message
A familiar sender name is not proof that a request is legitimate. Neither is a realistic signature, an accurate invoice number, or an existing email conversation.
The FBI’s business email compromise guidance describes schemes involving impersonation, fraudulent payment instructions, and compromised email accounts. Its advice includes independently verifying changes to account numbers and payment procedures.
Make that verification a written business rule:
- Confirm payment-detail changes independently. Call a previously verified number or use another trusted contact method—not information supplied in the request.
- Separate urgency from authority. A request presented as confidential or time-sensitive should not bypass approval requirements.
- Apply the rule consistently. Familiar vendors and senior executives should not receive exceptions simply because their names are recognizable.
In the opening scenario, the employee does not need to determine whether the email is fraudulent. The employee follows the established process and confirms the change through a trusted channel before payment.
Make Updates and Access Reviews Routine
Security weakens when routine maintenance has no clear owner. An outdated application, a forgotten contractor account, or unnecessary administrator privileges can create avoidable exposure.
Enable automatic updates where appropriate. For systems that require testing or planned downtime, assign responsibility for reviewing updates, evaluating urgency, and confirming installation. “Our provider handles that” is not enough unless the responsibilities and reporting are clear.
Apply the principle of least privilege: people should have the access necessary for their work, not every permission that might someday be convenient. Remove access when employees leave, and adjust it when responsibilities change.
The FTC’s small-business cybersecurity guidance provides practical support for software updates, access controls, and other foundational safeguards.
A useful access review asks who can approve payments, export customer information, change security settings, or administer backups. Confirm that each permission still has a business justification. Include outside IT providers and other vendors with access.
Build Visibility Without Creating Noise
Protection is incomplete if nobody notices when something goes wrong. Identify which security alerts matter and who is responsible for reviewing them.
Examples include unfamiliar account sign-ins, unexpected administrator changes, failed backups, and unusual forwarding rules in email. Ask your IT team or provider which events your systems can detect and how urgent alerts reach a responsible person.
Employees also need a simple reporting path. An unexpected authentication prompt or an accidentally opened attachment should be reported promptly, without fear that asking for help will trigger blame. Early reporting creates an opportunity to investigate before a problem grows.
Prepare for Recovery, Not Just Prevention
Backups are essential, but a successful backup notification does not prove that the business can recover.
The FBI’s ransomware guidance recommends regular backups, verifying that they completed, keeping them disconnected from the systems they protect, and developing a continuity plan.
Understand how your backup design provides that separation. If the same compromised account can delete both production data and its backups, recovery may be at risk. A synchronized folder alone should not be assumed to provide an independent backup.
Test a Real Restoration
Choose a representative set of important files and restore them to a safe location. Confirm that the files open, the information is usable, and authorized staff can complete the process.
Record what worked, what failed, and what dependencies appeared. Recovery may require more than data: application access, encryption keys, administrator credentials, and vendor assistance can all matter.
Then ask the business question: While recovery is underway, how will you serve customers, communicate with employees, and handle essential payments?
Write Down the First Response Steps
An incident is a poor time to decide who is in charge. Create a short response plan that people can find even when email or the company network is unavailable.
Include technical support contacts, an executive decision-maker, financial institution contacts, and relevant legal, insurance, and communications resources. Specify who can authorize operational changes and who communicates with employees, customers, and other affected parties.
For suspected payment fraud, contact the financial institution immediately and report the incident to the FBI’s Internet Crime Complaint Center, as described in its business email compromise guidance. Do not wait for a complete internal investigation before contacting the bank.
For a suspected technical compromise, involve qualified responders promptly. Preserve relevant messages and records, and follow their direction on containment rather than improvising changes that could destroy evidence or complicate recovery.
A Practical Starting Checklist
These are suggested starting actions, not a compliance standard or a substitute for legal, contractual, or industry-specific requirements:
- Choose your priorities: Identify essential accounts, systems, and information.
- Review authentication: Strengthen email, financial, and administrator access first.
- Document verification: Require independent confirmation of payment-detail changes.
- Assign maintenance: Name owners for updates, access reviews, and important alerts.
- Practice recovery: Restore important files and address the gaps you find.
- Preserve incident contacts: Keep the response plan accessible during an outage.
No individual safeguard guarantees safety. The objective is to make common attacks harder to execute, suspicious activity easier to recognize, and disruption easier to manage.
Start by assigning an accountable owner to each action and scheduling a recovery exercise. Cybersecurity becomes dependable when it moves from an occasional concern to a repeatable part of running the business.