The Small Business Cybersecurity Starter Guide

The Small Business Cybersecurity Starter Guide

Print this guide 15 min read · Printable

You do not need a large budget or a security team to be meaningfully safer. You need to do the right things in the right order. This guide gives you twelve steps. Work through them in sequence, mark each one done, and repeat the list once a year.

Step 1: Know what you have

List your computers, servers, network equipment, business applications, and cloud services, and who uses each one. You cannot protect what you do not know exists. Done when: you have a written inventory with an owner for every item.

Step 2: Turn on multi-factor authentication

Require a second sign-in step for email, remote access, financial systems, and administrator accounts. Done when: a stolen password alone cannot get anyone into those systems.

Step 3: Use a password manager

Give everyone a business password manager so passwords are long, unique, and not written on sticky notes or kept in spreadsheets. Done when: no shared spreadsheets of passwords remain.

Step 4: Keep everything updated

Apply updates to operating systems, applications, and network equipment on a schedule, and name one person who confirms it happened. Done when: you can show last month’s update records.

Step 5: Back up, then test the backup

Back up important systems automatically, keep a copy that an attacker on your network cannot delete, and restore something from backup to prove it works. Done when: you have restored a real file or system within the last six months.

Step 6: Protect email

Add filtering in front of your inboxes and give people one easy way to report suspicious messages. Done when: staff know exactly how to report a message and do so.

Step 7: Protect every device

Install managed endpoint protection on every computer and server, and make sure someone is alerted when it detects a problem. Done when: no device is unprotected or unmonitored.

Step 8: Limit access

Give people only the access their job requires, know who your administrators are, and remove access the same day someone leaves. Done when: an access review has been done in the last quarter.

Step 9: Train your people

Run short, regular awareness training for everyone, including leadership, and test with simulated phishing. Make it safe to report a mistake. Done when: everyone has completed training this year.

Step 10: Encrypt devices

Turn on device encryption and set up remote lock and wipe for laptops and phones. Done when: a lost laptop would be an inconvenience, not a breach.

Step 11: Watch for trouble

Enable sign-in alerts and make sure a named person reviews them. Fast detection limits damage. Done when: an unusual sign-in would reach a person quickly.

Step 12: Write your response plan

Document who to call, who decides, and how customers are told. Practice it once. Done when: the plan is on one page and everyone who needs it can find it.

Keep it going

Review the list every quarter. Add a new step when your business adds a new system, location, or service. Our Technology Insights page has a ten-minute scored check you can use to see where you stand today.