If your company lost access to email, payroll, or customer records tomorrow morning, how long could it keep operating? Who would make the decisions? And what evidence—not assumptions—shows that you could recover?
Those questions are a better starting point for cybersecurity than a shopping list of software. For business leaders without a dedicated security team, the priority is straightforward: understand what matters, protect access to it, and prepare for failures before they become emergencies.
The stakes are substantial. The FBI’s 2025 Internet Crime Report recorded 1,008,597 complaints and nearly $21 billion in reported losses. Those figures represent complaints and reported losses—not a count of every cyberattack or the full economic cost of cybercrime.
You do not need to solve every security problem at once. You do need named owners, repeatable safeguards, and proof that your most important protections work.
1. Identify What Your Business Cannot Operate Without
Start with business operations, not technical terminology. Which systems let you serve customers, collect revenue, pay employees, and meet contractual obligations?
For many organizations, the list includes email, accounting, payroll, customer records, shared files, and online sales. Include cloud services and outside providers: a system does not become less important because another company operates it.
The NIST small-business guide recommends maintaining an asset inventory and prioritizing protection according to sensitivity and business importance. A useful first version can be a simple worksheet:
- Critical asset: What system, service, or information supports the business?
- Business owner: Who is accountable for its business function?
- Administrator: Who controls its configuration and access?
- Sensitive data: What financial, employee, customer, or confidential information does it hold?
- Access and outage impact: Who needs access, and what happens if it becomes unavailable?
For example, an accounting platform may contain banking information, support vendor payments, and depend on one employee’s administrator account. That identifies several priorities immediately: protecting the account, verifying payment changes, and ensuring someone else can manage an emergency.
Protecting everything equally is not a strategy. Start with the systems whose failure would stop the business or cause the greatest harm.
2. Secure the Accounts That Control Everything Else
Some accounts have disproportionate power. Email can receive password-reset messages. Administrator accounts can change security settings. Banking and payroll accounts can move money or expose sensitive information.
Review those accounts first. Use long, random, unique passwords stored in a password manager. CISA’s cybersecurity essentials guidance recommends passwords of at least 16 characters and the strongest available multifactor authentication, highlighting physical security keys.
Multifactor authentication is not one uniform level of protection. Phishing-resistant methods, such as appropriately implemented security keys, provide stronger protection against credential phishing than codes someone can be tricked into handing over. MFA reduces risk; it does not make an account impossible to compromise.
- Enable strong MFA on email, financial systems, remote access, and administrator accounts.
- Remove former employees’ access promptly and review contractors’ access when engagements change.
- Keep everyday work separate from administrator privileges wherever practical.
- Document account-recovery procedures so they do not depend on one unavailable person.
If an outside provider manages these controls, ask for confirmation of what is enabled. “Our IT company handles that” is not evidence that every critical account is protected.
3. Verify Money Requests Outside the Message Thread
Consider this hypothetical: a familiar supplier emails new banking instructions shortly before an invoice is due. The message uses the correct names, references a real project, and asks for a quick acknowledgment.
It could be legitimate. It could also be business email compromise, in which an attacker impersonates a trusted party or uses a compromised account to redirect money. Familiar details do not prove that a request is authentic.
The FBI recommends independently verifying payment requests and account changes. Call the supplier using a number already established in your records—not a number included in the message requesting the change.
Create a written callback procedure for new payment instructions, changed bank details, and unusual transfers. For higher-risk payments, require a second authorized person to approve the transaction.
Make verification a routine business control, not an accusation. Employees should not have to decide whether a convincing email “feels suspicious” before following the procedure. The same rule should apply when the apparent sender is the CEO.
4. Make Basic Protection Routine
Security becomes fragile when it depends on someone remembering to act during a busy week. Turn essential safeguards into assigned, recurring work.
Update Software and Retire Unsupported Systems
Enable automatic updates where appropriate, and assign responsibility for confirming that important systems actually receive them. Include laptops, phones, browsers, applications, and internet-facing equipment. Unsupported software needs a replacement plan, not an indefinite exception.
Limit Access to What the Job Requires
Employees should have the information and permissions necessary for their responsibilities—not unrestricted access for convenience. Review access when people join, change roles, or leave. Pay particular attention to shared folders, financial systems, and privileged accounts.
Make Reporting Easy and Safe
Tell employees exactly where to report a suspicious message, an unexpected login prompt, or an accidental click. Encourage immediate reporting without blame. A person who reports quickly gives the organization an opportunity to respond.
For unexpected messages, the FTC recommends contacting the organization through a phone number or website already known to be genuine. Do not use the contact details inside the suspicious message to verify that same message.
5. Test Recovery Before You Need It
A successful backup notification does not prove that the business can recover. It shows that a backup process reported success. Restoration is a separate capability that requires testing.
CISA’s ransomware guidance recommends offline, encrypted backups and regular testing. The practical objective is to maintain recoverable copies that an attacker cannot easily destroy through the same access used to compromise production systems.
Choose a representative file or system and restore it in a controlled environment. Confirm that the information is intact and usable. For an application, check that the restored service works—not merely that its files exist.
Document four things:
- Scope: What was restored, and which dependencies were required?
- Time: How long did recovery actually take?
- Data: How much recent work would have been lost?
- Ownership: Who performed the restoration and verified the result?
Compare those results with business needs. A recovery process that takes longer than the business can tolerate needs improvement. Review backup integrity and system safety before restoration during a real incident; restoring into a still-compromised environment can undermine recovery.
6. Decide Who Acts When Something Goes Wrong
An incident is a poor time to discover that nobody has authority to suspend payments, contact the insurer, or approve emergency technical support.
Write a short response plan identifying the business decision-maker, technical responder, bank contact, insurer, and legal adviser. Include backup contacts and keep an accessible copy outside the systems that might become unavailable.
Walk through a realistic scenario: an employee reports an unfamiliar bank transfer, or staff suddenly cannot open shared files. Decide who coordinates the response, how technical evidence will be preserved, and who handles employee, customer, or regulatory communications with appropriate advice.
For a suspected fraudulent transfer, contact the financial institution immediately and report the incident to the FBI’s Internet Crime Complaint Center, IC3. Speed matters, but reporting does not guarantee that funds will be recovered.
A Practical Four-Week Starting Checklist
This is an editorial starting plan—not a regulatory deadline or a complete security standard. Adjust it to your organization’s risks and resources.
- First week: Inventory critical assets, name their business owners, and document outage consequences.
- Second week: Review important accounts, password practices, MFA, administrator privileges, and unnecessary access.
- Third week: Document payment-verification and suspicious-message reporting procedures. Explain them to employees.
- Fourth week: Test a restoration and walk through the incident contact plan. Assign owners and deadlines for gaps discovered.
Make Cybersecurity a Leadership Responsibility
Technology matters, but tools cannot decide which operations deserve priority or who is accountable when safeguards fail. Those are leadership responsibilities.
The NIST Cybersecurity Framework connects governance with identifying, protecting, detecting, responding, and recovering. That is the right mindset: cybersecurity is an ongoing business discipline, not a completed purchase.
Start this week. Name the owner of your most important system, review its access controls, and schedule a recovery test. Then ask: If that system stopped working tomorrow, who would act—and what evidence shows you could recover?