A supplier emails new banking instructions just before an invoice is due. An employee’s laptop stops working, taking important files with it. Someone gains access to the email account used to reset passwords for your other business applications. Different incidents, same underlying question: Can your business keep operating?
For small-business owners, cybersecurity should start with that question—not with a shopping list of security products. The priority is protecting the accounts, information, and services that let you serve customers, pay employees, and collect revenue.
You do not need a large security department to make meaningful progress. You do need clear ownership, reliable routines, and a realistic plan for when something goes wrong.
The NIST Cybersecurity Framework 2.0 organizes cybersecurity around six connected functions: Govern, Identify, Protect, Detect, Respond, and Recover. The practical lesson is straightforward: Prevention matters, but so do accountability, early warning, and recovery. The following six steps put that approach into action.
1. Know What Matters Most
Before choosing safeguards, identify what your business cannot afford to lose or operate without. For a consulting firm, that might be client documents and email. For a retailer, it might be payment processing, inventory records, and an online storefront.
Create a simple inventory covering:
- Essential accounts: Email, banking, payroll, accounting, website administration, and cloud storage.
- Business devices: Computers, phones, networking equipment, and other connected systems.
- Important information: Customer records, employee data, contracts, financial records, and intellectual property.
- Service providers: IT support, software platforms, payment processors, and backup providers.
For each item, record an owner and the business consequence of losing access. Ask how long you could operate without it and what alternatives exist.
Include dependencies. If your accounting platform requires email to reset a password, securing that email account is part of protecting your finances. If a provider manages your backups, confirm exactly what it protects and who initiates a restoration.
Practical action: Start with one page. Assign one person responsibility for maintaining it, even if outside specialists handle the technical work.
2. Strengthen the Accounts That Control Your Business
A stolen password should not be enough to unlock an essential business account. Enable multifactor authentication, or MFA, wherever available, starting with email, financial services, cloud storage, and administrator accounts.
MFA adds another requirement beyond a password. Where supported, consider phishing-resistant options such as passkeys or hardware security keys. Other MFA methods still provide important protection compared with relying on a password alone.
NIST’s small-business Cybersecurity Framework overview recommends MFA, considering password managers, and changing default manufacturer passwords.
Put those recommendations into a repeatable process:
- Use unique passwords, managed through a reputable password manager.
- Give employees individual accounts rather than shared credentials.
- Limit administrator privileges to people who need them.
- Remove access promptly when employees or contractors leave.
- Protect recovery codes and review account-recovery contact details.
Turn on available alerts for unfamiliar sign-ins and security-setting changes. Assign someone to review them. An alert nobody monitors is not an effective detection process.
3. Make Software Maintenance Someone’s Job
Software updates often fix security weaknesses, but “we usually update things” is not a dependable control. Name the person responsible for checking that updates actually happen.
Include operating systems, browsers, business applications, phones, routers, and other network equipment. Enable automatic updates where appropriate, and confirm that devices receive them successfully. A computer waiting indefinitely for a restart may still be missing important fixes.
For a critical application, coordinate updates with its provider or IT support team so you can address compatibility and recovery concerns. That should create a controlled maintenance process—not an excuse to postpone updates indefinitely.
Also identify unsupported software and equipment. If a vendor no longer supplies security updates, replacement or retirement needs to become a business decision with an owner and a deadline.
Practical example: A monthly device review might reveal that a rarely used office laptop has missed updates for months. Catching that gap is more useful than assuming every device follows the same automatic-update settings.
4. Verify Unusual Requests Before Acting
Some attacks succeed by persuading an authorized employee to do something harmful: send money, disclose information, or approve access. Technical safeguards help, but payment and identity-verification procedures are equally important.
The Federal Trade Commission’s small-business cybersecurity guidance recommends independently verifying emailed wire-transfer requests. Use contact information you already know is correct—not a telephone number or link supplied in the suspicious message.
For example, if a supplier requests a bank-account change, call the supplier using the number in your established records. Do not treat a familiar display name, professional invoice, or existing email conversation as sufficient proof.
Apply the same discipline to unexpected requests for sensitive files, password resets, and remote access. A convincing voice or urgent message should not override your process.
- Require independent verification of payment-detail changes.
- Use a second approver for sensitive transactions where feasible.
- Give employees a clear way to report suspicious requests.
- Make it explicit that pausing to verify will not be punished.
Urgency is a reason to follow the verification process carefully—not a reason to bypass it.
5. Test Recovery, Not Just Backups
A backup dashboard showing successful jobs does not prove that your business can recover. The meaningful test is whether you can restore the information you need, in usable form, within an acceptable period.
NIST recommends backing up data and testing backups. The FTC also recommends keeping backup copies disconnected from the network. The goal is to prevent the same incident from destroying both working information and its recovery copies.
Depending on your environment, that may involve offline copies or appropriately configured immutable storage that resists alteration or deletion. Backup administration should also be protected from compromised everyday accounts.
Do not assume cloud storage or file synchronization provides everything you need. Synchronization can propagate unwanted changes; backup capabilities and retention vary by service.
Run a Small Restoration Exercise
Choose an important folder or business record. Restore it to a safe location, check that it opens correctly, and record how long the process takes. Then ask:
- How much recent work would we lose?
- Could we restore an entire critical system?
- Could we recover if our normal administrator account were unavailable?
- Who has the instructions and authority to begin?
Use the answers to improve the recovery plan before a disruption makes those gaps urgent.
6. Prepare a Response Plan Before You Need It
During an incident, uncertainty wastes time. A short, accessible response checklist is more valuable than an elaborate document nobody can find.
Name the decision-maker, technical support contact, reporting route, and recovery priorities. Keep essential contact information somewhere you can reach even if business email is unavailable.
Include These Decisions in Your Checklist
- Reporting: How should employees report suspicious activity, including when email may be compromised?
- Containment: Who can isolate affected devices or suspend compromised accounts?
- Evidence: What messages, logs, and details should be preserved for investigation?
- Communication: Who coordinates with employees, customers, providers, insurers, and legal advisers?
- Continuity: Which operations can continue safely, and which must pause?
Contact qualified IT support promptly. Avoid wiping devices or deleting suspicious messages before receiving guidance; doing so can remove useful evidence. Notification duties depend on the circumstances, contracts, and applicable law, so identify appropriate advisers in advance.
Rehearse a scenario such as a compromised email account. Walk through who acts first, how they communicate, and what happens if the primary decision-maker is unavailable.
A Practical Four-Week Checklist
This is an implementation schedule, not an official NIST deadline. Adjust it to your risks and resources, and address urgent weaknesses immediately.
- First week: Inventory essential accounts, identify owners, and enable MFA on priority accounts.
- Second week: Review software maintenance and introduce independent payment-verification procedures.
- Third week: Confirm backup coverage and complete a restoration test.
- Fourth week: Rehearse the incident-response checklist and assign outstanding tasks.
Repeat these reviews as employees, systems, and providers change. Completing a checklist does not establish legal compliance or make a business immune to attacks.
Start With One Account, Then Build the Habit
Effective cybersecurity is an ongoing management responsibility: know what matters, reduce avoidable weaknesses, recognize warning signs, and practice recovery. The aim is not perfect security. It is a business better prepared to withstand disruption.
Choose one essential account today, verify its security settings, and assign an owner to the remaining checklist. That concrete first step turns cybersecurity from a vague concern into work your business can manage.