An urgent invoice arrives from a familiar supplier. The logo looks right, the amount seems reasonable, and the message says payment is overdue. An employee, trying to keep business moving, follows the instructions. The problem is not necessarily a sophisticated technical failure. It may be a missing verification step.
Cybersecurity is the work of protecting accounts, devices, information, and operations from unauthorized access and disruption. For individuals and small businesses, it starts with practical habits—not an expensive collection of tools.
A useful plan covers prevention, detection, and recovery. The FTC’s small-business cybersecurity guidance, drawing on NIST’s Cybersecurity Framework, takes this broader approach. Stopping attacks matters, but so does recognizing trouble and restoring operations when something goes wrong.
The following six steps turn that approach into a manageable checklist.
1. Protect Your Most Important Accounts First
Your email account deserves particular attention. It often receives password-reset messages for other services, making it a potential gateway to financial accounts, business systems, and sensitive documents.
Start by listing your most important accounts: email, banking, payroll, cloud storage, website administration, and any service that controls access to other systems.
Strengthen How You Sign In
- Use long, unique passwords. A password manager can generate and store them, reducing the temptation to reuse one password across services.
- Enable multifactor authentication. MFA adds protection beyond a password. Where available, choose phishing-resistant sign-in using FIDO-based passkeys or security keys.
- Protect account recovery. Review recovery email addresses and phone numbers. Store recovery codes securely, somewhere you can access if your primary account becomes unavailable.
Not all MFA offers the same protection. Authenticator codes and text-message codes can still be stolen through phishing. In guidance written for highly targeted individuals, CISA recommends FIDO-based authentication because of its phishing resistance. That distinction is useful more broadly, although no authentication method should be described as unhackable.
If phishing-resistant authentication is unavailable, enable the strongest supported MFA option rather than leaving the account protected only by a password.
Your next step: Record each critical account, its owner, whether its password is unique, and which authentication method protects it. Prioritize gaps in email and administrator accounts.
2. Verify Unexpected Requests Independently
Phishing attempts try to persuade people to reveal information, open malicious attachments, or follow dangerous links. They may arrive through email, text messages, phone calls, or collaboration tools.
Do not rely on spelling mistakes or an unfamiliar logo to identify them. A polished message can still be fraudulent, and a message from a familiar account may come from an attacker who has taken it over.
Pause, verify through a separate channel, then act.
Suppose a supplier emails new bank details just before a payment is due. Do not confirm the change by replying to that email or calling the number included in it. Call a previously verified contact using a number already in your records.
The same principle applies to account warnings. Rather than following a message’s link, open the organization’s known website or official app independently. The FTC’s phishing guidance recommends contacting organizations through a website or phone number you know is genuine.
For businesses, make verification a process rather than a judgment call. Require independent confirmation for changes to payment instructions, and consider a second approver for sensitive transactions. Give employees a clear way to report suspicious messages without fear of blame.
Your next step: Agree on which requests always require independent verification, especially payments, password resets, and requests for sensitive information.
3. Keep Software Updated—and Confirm It Happens
Software updates do more than add features. They can fix vulnerabilities that attackers might exploit. Operating systems, browsers, applications, network equipment, and security software all need attention.
Enable automatic updates where practical. Restart devices when required, and check that updates complete successfully. A setting that says updates are enabled is not proof that every device is current.
For a business, assign responsibility for this work. An employee, internal IT team, or service provider should know which systems exist, which require updates, and how failures will be identified. Software that no longer receives security updates needs a replacement or risk-reduction plan.
Critical systems may require coordinated maintenance, but indefinite postponement is not a strategy. Decide who evaluates an update, schedules it, and verifies completion.
Your next step: Review update settings on your phone and computer. For business devices, identify who owns update oversight and how they report exceptions.
4. Make Recovery Possible Before You Need It
Backups protect against more than cyberattacks. They can also help recover from accidental deletion, device failure, and other disruptions. But a backup is useful only if the information you need can actually be restored.
Identify your essential data first. For a household, that might include financial records and irreplaceable photos. For a business, it could include customer records, contracts, accounting data, and configuration information needed to rebuild systems.
- Back up regularly. Set the frequency according to how much recent work you can afford to lose.
- Keep protected copies. Maintain offline, encrypted backups of critical business data, and protect the credentials and keys needed to restore them.
- Test restoration. Confirm that recovered files are complete, usable, and available when needed.
The joint federal #StopRansomware Guide recommends testing backup availability and integrity in a disaster-recovery scenario. A successful backup notification is not a substitute for that exercise.
Cloud synchronization alone is not necessarily a backup: unwanted changes or deletions may synchronize too. Understand what your service retains and how restoration works.
Your next step: Restore a sample file to a safe location and open it. Then ask whether you could recover essential operations—not just individual documents.
5. Reduce Unnecessary Access and Watch for Changes
You cannot protect what you do not know you have. Businesses need a working inventory of devices, software, important data, and external services, along with an owner for each.
Next, apply the principle of least privilege: give people only the access needed for their jobs. Someone who needs to read a document does not automatically need permission to share it publicly. Someone who uses a system does not automatically need administrator rights.
Review access when employees change roles or leave. Include contractors and service providers. Where practical, separate everyday accounts from administrator accounts so routine work does not carry unnecessary privileges.
Make Detection Someone’s Responsibility
Enable useful alerts for events such as unexpected sign-ins, password changes, new administrator accounts, and unusual financial activity. Business email forwarding rules and external file-sharing changes also deserve attention.
Alerts help only when someone reviews them. Decide who investigates unusual activity and how concerns are escalated. Outsourcing technology support does not remove the need to understand who is watching what.
Your next step: Review who can access sensitive files and administer important services. Remove access that no longer has a clear business purpose.
6. Write a Basic Incident-Response Plan
An incident is a poor time to discover that every emergency contact is stored inside an inaccessible email account. Keep an accessible contact sheet, including an offline copy where appropriate.
A basic response plan should identify:
- Decision-makers: Who can authorize shutdowns, spending, and operational changes?
- Technical help: Who will investigate, contain the incident, and guide recovery?
- Communication channels: How will people coordinate if email is unavailable or compromised?
- Operational priorities: Which services must be restored first, and what temporary workarounds exist?
- Reporting responsibilities: Who will assess contractual, insurance, legal, and regulatory obligations?
NIST’s small-business guidance emphasizes documenting contacts, responsibilities, authority, and applicable reporting obligations. Following a framework, however, does not by itself establish legal or regulatory compliance.
Rehearse a simple scenario: business email becomes unavailable during a busy workday. Can your team reach technical support, verify instructions, and continue essential work? During a real incident, coordinate containment with qualified help and preserve relevant messages and logs rather than making indiscriminate changes that could destroy evidence.
Your next step: Write the contact sheet and walk through the email-outage scenario with the people named in it.
Your Cybersecurity Action Checklist
- Inventory important accounts and identify their owners.
- Strengthen passwords and enable phishing-resistant authentication where supported.
- Practice independent verification of unexpected requests.
- Check automatic updates and assign oversight.
- Test a backup restoration.
- Document access permissions and incident contacts.
Build a Routine, Not Just a One-Time Project
No checklist guarantees protection. These steps reduce avoidable risk and improve your ability to recognize and recover from problems.
Start today with your primary email account, one update check, and one backup restoration. For a business, assign an owner to every remaining action and set a review date. Cybersecurity becomes more manageable when it is treated as a repeatable operating discipline—not something to address only after an urgent message becomes a costly mistake.