Imagine a familiar supplier sends an invoice with one change: payment should now go to a different bank account. The message looks professional, the amount is expected, and the deadline is approaching. Do you pay—or pause to verify?
In this hypothetical situation, a short phone call to an established contact could prevent a costly mistake. It illustrates an important cybersecurity principle: protection depends on everyday decisions as much as technology.
Cybersecurity means managing the risks to your accounts, devices, information, and operations. For individuals and small businesses, the best starting point is practical: secure important accounts, verify unusual requests, maintain your technology, and prepare to recover when something goes wrong.
Cybersecurity is not a product you buy once. It is an ongoing process of reducing risk and making problems easier to detect, contain, and recover from.
1. Secure the Accounts That Control Everything Else
Your primary email account deserves special attention. It often receives password-reset links for other services, making it a gateway to your financial accounts, business applications, and personal information. Protect it alongside your password manager, banking accounts, and business administrator accounts.
Use unique passwords and a password manager
Reusing a password connects otherwise separate accounts. If one service suffers a breach, criminals may try the exposed credentials elsewhere. A strong password does not solve this problem if you use it repeatedly.
Follow the FBI’s online safety guidance: use unique passwords or passphrases and store them in a reputable password manager. Let the manager generate long passwords rather than inventing slight variations of the same one. Protect the manager itself with a strong, unique master passphrase and multifactor authentication.
Choose stronger authentication where available
Multifactor authentication, or MFA, adds another requirement beyond a password. But the method matters. CISA recommends phishing-resistant MFA for businesses. Physical security keys and properly implemented passkeys offer stronger protection against phishing than text or email codes.
Use passkeys where supported; not every service offers them. If stronger options are unavailable, enable the MFA the service provides rather than leaving the account protected only by a password. Never approve an unexpected authentication prompt or share a verification code with someone who contacts you.
Prepare for lost access: Store recovery codes securely, separately from the device you might lose, and keep recovery contact information current.
2. Verify Requests Before You Trust Them
Phishing is an attempt to trick you into revealing information, approving access, sending money, or opening something harmful. It can arrive through email, text messages, phone calls, or collaboration tools. Correct spelling, a familiar logo, and a confident voice are not proof of legitimacy.
Look for the action being requested, not just the appearance of the message. An unexpected demand to change payment details, disclose credentials, install software, or bypass normal approval deserves scrutiny.
Return to the hypothetical invoice. The safest next step is not replying to ask whether it is genuine: an attacker controlling the conversation can simply say yes. Call the supplier using a number already in your records, not one supplied in the message.
- Unexpected login warning: Open the service through its official app or your saved bookmark instead of following the message’s link.
- Urgent request from an executive: Confirm through an established contact method before sending money or sensitive files.
- Unsolicited support call: Do not provide remote access. Contact your provider through a trusted channel.
For businesses, make independent verification a written requirement for payment-detail changes. A consistent procedure protects employees from having to challenge apparent authority without support.
3. Keep Devices and Software Maintained
Software updates frequently fix security weaknesses that attackers could exploit. Delaying them leaves preventable gaps in otherwise reasonable defenses.
Enable automatic updates where available for operating systems, browsers, applications, and security software. Restart devices when needed to complete installation. Include phones, tablets, routers, and other connected equipment—not just laptops.
Some equipment requires manual attention. Assign responsibility for checking router firmware and other infrastructure updates. In a business, confirm that updates actually installed rather than assuming an automatic setting guarantees success.
Unsupported technology needs a replacement plan. A device can still function while no longer receiving security fixes. Treat continued use as a risk decision, not evidence that the equipment remains safe.
For systems essential to operations, coordinate updates with the responsible provider and an appropriate maintenance window. The goal is reliable maintenance, not indefinite postponement.
4. Build Backups You Can Actually Restore
A backup is useful only if it contains the right information, survives the incident, and can be restored. A successful backup notification does not prove all three.
Start by identifying what you cannot afford to lose: financial records, customer information, operational documents, and essential system settings. Set backup frequency according to how much recent work you could reasonably recreate.
The FTC’s small-business cybersecurity guidance recommends keeping a backup on a drive or server disconnected from the network as part of ransomware preparation. An attached backup can be exposed to the same attack affecting your working files.
Cloud synchronization is not automatically a complete backup strategy. Depending on the service and configuration, unwanted changes or deletions may synchronize too. Check retention, version history, access controls, and restoration options.
Test recovery: Restore selected files to a separate location and confirm they open correctly. Businesses should also test the steps needed to resume an essential activity. Document the process so recovery does not depend on one person’s memory.
5. Give Business Cybersecurity a Clear Owner
Small businesses do not necessarily need a large security department. They do need someone accountable for ensuring essential work happens. An outside IT provider can perform tasks, but leadership still needs visibility into risks and decisions.
Begin with a simple inventory of hardware, software, cloud services, important data, and the people responsible for each. Include accounts and services employees purchase independently for work.
Then establish these operating habits:
- Limit access: Give people only the access their work requires. Use separate administrator accounts for administrative tasks.
- Manage departures: Remove access promptly when employees or contractors leave, including access to shared services.
- Train for real decisions: Practice spotting payment changes, unexpected login prompts, and requests for sensitive information.
- Encourage reporting: Make it easy to report mistakes or suspicious activity without fear of blame.
- Confirm provider responsibilities: Know who handles updates, monitors alerts, maintains backups, and assists during incidents.
NIST’s Cybersecurity Framework 2.0 offers a useful organizing structure: Govern, Identify, Protect, Detect, Respond, and Recover. These functions help businesses move beyond prevention alone. The framework is voluntary guidance, not a certification or a guarantee of legal compliance.
6. Decide What to Do Before an Incident Happens
A short incident-response plan is better than improvisation under pressure. Keep an accessible copy outside the systems you might lose access to.
Record whom to contact, who can authorize urgent decisions, and how to reach your IT provider, financial institution, and relevant insurance contact. Identify an alternative communication channel if business email is compromised.
If you suspect a compromise, contact the responsible technical team promptly. If a device appears infected, disconnect it from the network while seeking guidance; do not immediately wipe it and destroy potentially useful evidence. Use a separate, trusted device for sensitive recovery actions.
If money was sent fraudulently, contact the financial institution immediately. For businesses, assess reporting and notification obligations with qualified advisers; requirements depend on the circumstances and applicable laws.
Your Seven-Day Cybersecurity Starter Checklist
This editorial schedule turns the priorities above into manageable steps. It is a starting point, not a security certification.
- Days 1–2: Replace reused passwords, starting with email and financial accounts. Set up a password manager and enable the strongest available authentication. Save recovery codes securely.
- Days 3–4: Review device and application updates, including router software. Establish a separate-channel verification procedure for payment changes and sensitive requests.
- Days 5–6: Review what your backups cover, protect a copy from network-based attacks, and test restoring important files.
- Day 7: Write down incident contacts and initial response steps. For a business, name the security owner and schedule recurring reviews.
Start With the Next Useful Action
No tool or checklist can promise complete protection. Effective cybersecurity combines stronger account controls, careful verification, maintained technology, and tested recovery—with clear responsibility for keeping those practices working.
Choose one action today: secure your primary email account, verify a payment change, or test a backup. Then put the remaining steps on your calendar. The objective is not to eliminate every possible risk. It is to reduce avoidable exposure and be ready to respond when something goes wrong.