Published: November 1, 2026
Consider a hypothetical situation: Your bookkeeper receives an email from a familiar supplier. The invoice looks right, the sender’s signature is recognizable, and the message explains that the supplier has changed banks. Payment is due today. Your employee updates the banking information and sends the money.
The invoice was real. The new bank account belonged to a criminal.
This is why cybersecurity cannot be treated only as a technology problem. Protecting a business means protecting the decisions, accounts, information, and systems that keep it operating. Security software matters, but so does the procedure someone follows before changing payment instructions.
You do not need to solve every cybersecurity problem at once. You need clear priorities, accountable owners, and evidence that your safeguards work. Start with the actions that protect access, prevent unauthorized payments, and make recovery possible.
1. Identify What Your Business Cannot Operate Without
Before buying another security product, identify what you are protecting. If your email, payment platform, or customer database became unavailable tomorrow, which activities would stop? What information would be difficult—or impossible—to replace?
The NIST Cybersecurity Framework 2.0 small-business guide organizes cybersecurity around six functions: Govern, Identify, Protect, Detect, Respond, and Recover. The practical message is straightforward: Security includes leadership and recovery, not just prevention.
Create a short inventory covering:
- Critical services: Email, accounting, payroll, customer records, payment processing, and essential cloud applications.
- Sensitive information: Customer details, employee records, financial information, and confidential business documents.
- Responsible people: The executive accountable for security and the person or provider responsible for each critical service.
- Dependencies: Outside providers, support contacts, and recovery arrangements.
Use this inventory to set priorities. A system that controls payments or stores sensitive customer information generally deserves attention before an application with little business impact. If an outside IT provider manages security, document what it handles and what remains your responsibility.
2. Protect the Accounts That Control Everything Else
Your email account is more than a mailbox. It may receive password-reset messages, approve transactions, and provide access to business conversations. Administrator accounts can change settings and permissions across entire systems. Protect these accounts first.
Use stronger sign-in methods
CISA recommends phishing-resistant multifactor authentication. Where supported, prioritize FIDO2 passkeys with user verification or appropriately configured security keys. Ask your provider whether its implementation delivers phishing-resistant authentication; not every configuration provides the same protections.
If those options are not available immediately, enable the strongest supported MFA now. Authenticator codes and text-message codes can improve protection compared with passwords alone, but they can still be captured through phishing. Do not postpone available safeguards while planning a stronger approach.
For accounts that still require passwords, use a password manager to create and store unique passwords. Protect the password manager itself with strong authentication, and establish a secure recovery process.
Reduce unnecessary access
Give each employee an individual account. Restrict administrator privileges to people who need them, and use separate administrative accounts where practical. Remove access promptly when someone leaves or changes roles.
Document emergency access, too. A business should not lose control of its systems because the only administrator is unavailable. Store recovery information securely and make sure an authorized backup person knows how to retrieve it.
3. Make Payment Verification a Business Rule
A convincing message is not proof that a request is legitimate. An attacker may impersonate an executive, compromise a supplier’s mailbox, or insert fraudulent instructions into an existing conversation.
The FBI’s business email compromise guidance recommends verifying payment requests and changes to account numbers or payment procedures. Use a previously known telephone number—not one supplied in the questionable message.
Before changing payment details, verify the request through a trusted contact channel already on file.
Make that rule routine rather than discretionary. In the hypothetical invoice example, the bookkeeper would call the supplier’s established accounting contact before changing the bank details. The payment would remain on hold until verification was complete.
Apply similar controls to unusual transfers, payroll changes, and requests for sensitive records. For higher-risk transactions, require a second authorized person to approve the payment. Define the approval threshold in advance.
AI-generated writing, cloned voices, and manipulated video add another reason not to rely on appearance or familiarity alone. A voice that sounds like the CEO should not override your payment procedure. Independent verification is the control; recognizing a fake is not.
4. Turn Routine Protection Into Measurable Work
“Keep everything updated” is good advice, but it is not an operating process. Someone needs to know which devices exist, whether updates installed, and what happens when an update fails.
The FTC’s small-business cybersecurity guidance recommends regular updates, restricted access, employee training, and monitoring for unauthorized activity. Translate those recommendations into questions with clear answers:
- Updates: Are operating systems, browsers, applications, and internet-facing equipment receiving security updates?
- Unsupported technology: Which devices or applications no longer receive fixes, and when will they be replaced?
- Access: Who can view, download, or share sensitive customer and employee information?
- Monitoring: Who reviews suspicious sign-in alerts, and how quickly can that person act?
- Reporting: Can employees report a questionable message without navigating a complicated process?
Enable automatic updates where appropriate, then verify that they are working. Collecting alerts is not the same as monitoring them: Assign responsibility for reviewing and escalating important warnings.
Keep employee training practical. Use clearly labeled hypothetical examples involving invoices, password resets, document-sharing requests, and urgent executive instructions. Teach people where to report concerns, and avoid blaming employees who report mistakes promptly. Early reporting gives responders a better opportunity to limit damage.
5. Prove That You Can Recover
A successful backup notification does not prove that your business can recover. The meaningful test is whether you can restore usable information within a timeframe the business can tolerate.
CISA’s ransomware guidance recommends offline, encrypted backups of critical data and regular recovery testing. Ordinary cloud synchronization is not necessarily a backup: It can replicate encrypted or deleted files rather than preserve a usable recovery copy.
Start by restoring a sample file to a safe location. Confirm that it opens, contains the expected information, and is recent enough to be useful. Record the result and any problems.
Then test beyond individual files. Could you restore the accounting application, recover its configuration, and give authorized employees access? Would you have the necessary credentials and encryption keys if your normal systems were unavailable?
Define how much data loss and downtime each critical process can tolerate. Those business requirements should guide backup frequency and recovery arrangements. Protect backup access separately so a compromised everyday account cannot easily destroy your recovery options.
6. Prepare Your Incident Response Before the Emergency
During an incident, people need decisions and contact information—not a document they cannot access. Maintain a concise response plan and an offline copy, as recommended in CISA’s ransomware guidance.
Include contacts for leadership, IT support, financial institutions, incident-response specialists, legal advisers, and your cyber insurer where applicable. Identify who can authorize emergency spending and who will communicate with employees, customers, and other affected parties.
Rehearse a hypothetical scenario: An employee reports sending money after receiving fraudulent banking instructions. Who calls the bank? Who secures the affected account? Who preserves the messages?
If a fraudulent transfer may have occurred, contact the financial institution immediately and report the incident to the FBI’s Internet Crime Complaint Center, IC3. Do not wait for a complete investigation before contacting the bank.
For a suspected system compromise, involve qualified responders promptly. Follow their guidance on containment and evidence preservation; avoid wiping affected devices before understanding what evidence may be needed.
Your Cybersecurity Action Checklist
Turn these priorities into assignments. For each item, record one accountable owner, one next action, and one completion date:
- Inventory critical systems, sensitive information, and outside providers.
- Strengthen authentication for email, administrator accounts, and financial services.
- Require independent verification of payment-detail changes.
- Confirm that updates, access reviews, and alert handling actually happen.
- Restore backup data and document the result.
- Create an offline incident contact sheet and rehearse the response.
No checklist eliminates cyber risk or guarantees regulatory compliance. But disciplined execution can reduce exposure and improve your ability to respond when something goes wrong.
Start today: Choose the highest-risk gap, assign an owner, and put its completion date on the calendar. Effective cybersecurity is not a purchase you finish. It is a business practice you maintain.